54.2. 使用 RBCD 委托对服务的访问

流程

1. 在 client.example.test 主机上，获取一个 Kerberos 票据：

   # kinit -k

   Copy to Clipboard Toggle word wrap

2. 定义 RBCD ACL：

   # ipa service-add-delegation nfs/client.example.test HTTP/client.example.test
   
   -------------------------------------------------------
   Added new resource delegation to the service principal "nfs/client.example.test@EXAMPLE.TEST"
   -------------------------------------------------------
     Principal name: nfs/client.example.test@EXAMPLE.TEST
     Delegation principal: HTTP/client.example.test@EXAMPLE.TEST

   Copy to Clipboard Toggle word wrap

1. 查看 NFS 服务，以验证委托规则是否存在：

   # ipa service-show nfs/client.example.test
   
     Principal name: nfs/client.example.test@EXAMPLE.TEST
     Principal alias: nfs/client.example.test@EXAMPLE.TEST
     Delegation principal: HTTP/client.example.test@EXAMPLE.TEST
     Keytab: True
     Managed by: client.example.test

   Copy to Clipboard Toggle word wrap

2. 为 HTTP 服务主体获取一个 Kerberos 票据：

   # kinit -kt http.keytab HTTP/client.example.test

   Copy to Clipboard Toggle word wrap

3. 验证票据授予票据是否存在：

   # klist -f
   Ticket cache: KCM:0:99799
   Default principal: HTTP/client.example.test@EXAMPLE.TEST
   
   Valid starting       Expires              Service principal
   10/13/2023 14:39:23  10/14/2023 14:05:07  krbtgt/EXAMPLE.TEST@EXAMPLE.TEST
   	Flags: FIA

   Copy to Clipboard Toggle word wrap

4. 代表 testuser 执行协议转换：

   # kvno -U testuser -P nfs/client.example.test
   nfs/client.example.test@EXAMPLE.TEST: kvno = 1

   Copy to Clipboard Toggle word wrap

5. 验证在协议转换过程中代表 testuser 获得的票据是否存在：

   # klist -f
   Ticket cache: KCM:0:99799
   Default principal: HTTP/client.example.test@EXAMPLE.TEST
   
   Valid starting       Expires              Service principal
   10/13/2023 14:39:38  10/14/2023 14:05:07  HTTP/client.example.test@EXAMPLE.TEST
   	for client testuser@EXAMPLE.TEST, Flags: FAT
   10/13/2023 14:39:23  10/14/2023 14:05:07  krbtgt/EXAMPLE.TEST@EXAMPLE.TEST
   	Flags: FIA
   10/13/2023 14:39:38  10/14/2023 14:05:07  nfs/client.example.test@EXAMPLE.TEST
   	for client testuser@EXAMPLE.TEST, Flags: FAT

   Copy to Clipboard Toggle word wrap