Re: [nfsv4] Path forward for flex-files

[Benjamin Kaduk <[e-mail]>]

On Tue, Aug 08, 2017 at 12:20:26AM +0000, Rick Macklem wrote:
> Benjamin Kaduk wrote:
> [stuff snipped]
> > The solution space looks rather different whether the synthetic principals
> > are actually being created/deleted on the KDC or synthesized using the
> > data server's keytab.
> I'm not sure what you are thinking of w.r.t. synthesized using the data server's keytab,
> but I am curious?

A service ticket is "just" some DER-encoded data encrypted+MAC'd in a symmetric
key shared between the KDC and the service principal (in the simple case).
When the service application receives a service ticket along with the client's
request, the service knows that the ticket came from the KDC because the
MAC verifies, generating/verifying the MAC requires that symmetric shared
key, and the service knows that it didn't generate the ticket itself.
Note the logical leap at the end -- it's assumed from the KDC because the
KDC is the only other party that's supposed to have the key material.
But really, anyone with the right key can encode the right data and encrypt+MAC
it using that key -- this allows one to print a ticket to onesself that
claims to be for a client principal that does not even exist in the
KDC's database.

We use this "ticket printing" technique in AFS for server-to-server
communications, and it's exposed to some maintenance tools as well.

-Ben