🚀 go-pugleaf

> For various reasons, I need to perform the following sequence of operations:
> 
> 1. Run kinit (or equivalent) on machine A
> 2. Run telnet/rlogin/rsh like utility on machine A
> 	2a. utility contacts machine B
> 	2b. server on machine B authenticates user from A
> 	2c. server on machine B creates new ticket file for user on B
> 	2d. server on machine B runs desired command under user's environment.
> 3. server on machine B removes tickets and cleans up in general after
>    command has completed
> 
> The problem I have is that I can't figure out how to do step 2c. 
> For example, if the command passed to B is "klist", it should list just the
> krbtgt ticket for that user. The V4 rsh/etc. tools will not do step 2c
> 
> 
> The reason I want to do this is to allow the command run on machine B to 
> run as the user and get tickets of it's own for other operations. I just
> need some way to propigate the krbtgt ticket.

the user on "a" wants to allow some service or entity on "b" to acquire
a tgt for the user.  "a" mutually authenticates with some service on
"b", establishing a session key with "b".  the service on "b" can
request a tgt for the user and pass the response back to "a" for
decryption.  "a" decrypts the tgt, reencrypts it with the session key
it shares with "b" and sends back to result to "b" who proceeds to then
use it.  since you probably don't want the user on "a" to type in their
password twice, you would probably hack kinit to first acquire the tgt
for the user on "a" and then reuse that password to decrypt the tgt
on behalf of the service on "b".

					cheers,
					bruce