Wallet...in::AD(3pm)

📦 version 1.7, in debian trixie, ubuntu resolute, ubuntu stonking

💖 Wallet::Kadmin::AD — the Active Directory kadmin glow-up 💖

okay so bestie, welcome to Wallet::Kadmin::AD(3pm) — it's a User Contributed Perl Documentation page, and it's literally the Wallet Kerberos administration API for Active Directory. yes that's a mouthful, we're doing it anyway 🫶

✨ NAME ✨

Wallet::Kadmin::AD — Wallet Kerberos administration API for Active Directory. she does kerberos admin stuff, and she does it in AD. periodt 💅

🌸 SYNOPSIS 🌸

here's the whole vibe in code, no notes:

my $kadmin = Wallet::Kadmin::AD->new;
$kadmin->create ('host/foo.example.com');
my $data = $kadmin->keytab_rekey ('host/foo.example.com');
$data = $kadmin->keytab ('host/foo.example.com');
my $exists = $kadmin->exists ('host/oldshell.example.com');
$kadmin->destroy ('host/oldshell.example.com') if $exists;

like. new up an object, make a principal, rekey it, grab the keytab, check if the old one exists, and if she does — destroy her. iconic behavior honestly 😭✨

🦋 DESCRIPTION 🦋

so Wallet::Kadmin::AD implements the Wallet::Kadmin API for Active Directory Kerberos — like, it's the AD-specific flavor of that API. it gives you an interface to create and delete principals and to create keytabs. basically it provides the API that's documented in Wallet::Kadmin, but for an Active Directory Kerberos KDC. slay 👑

now here's a fun little technical situation, and it's giving workaround: AD Kerberos does not provide any method via msktutil to retrieve a keytab for a principal without rekeying it. so the keytab() method — as opposed to keytab_rekey(), which does rekey the principal — is implemented using a local keytab cache. lowkey clever, highkey necessary 💀

also!! to use this class, several configuration parameters must be set. see "KEYTAB OBJECT CONFIGURATION" in Wallet::Config for the deets, iykyk 💜

🎀 LIMITATIONS 🎀

ngl, currently this implementation calls an external msktutil program rather than using a native Perl module. which means: msktutil has to be installed, and this thing parses its output. that's the tradeoff, bestie 🙈

⚠️ real talk: because it's shelling out to msktutil and parsing what comes back, msktutil being installed is a hard requirement. no msktutil, no vibe check. 💀

🌈 SEE ALSO 🌈

this module is part of the wallet system 💖 and the current version is available from <https://www.eyrie.org/~eagle/software/wallet/>. go get her 🫶

👑 AUTHORS 👑

the legends who made this happen:

  • Bill MacAllister <whm@dropbox.com>
  • Russ Allbery <eagle@eyrie.org>
  • Jon Robertson <jonrober@stanford.edu>

and that's the whole page!! 🎀 this one's from perl v5.40.0, dated 2024-11-12 — so like, write that down bestie, that's the receipts. mwah, go create some principals 💅✨🦋

📦 where this page comes from