Wallet...in::MIT(3pm)

📦 version 1.7, in debian trixie, ubuntu resolute, ubuntu stonking

💖 Wallet::Kadmin::MIT — the perl manual, but make it cute 💖

okay so bestie, you're looking at Wallet::Kadmin::MIT, a 3pm manual page from the User Contributed Perl Documentation collection. it's giving ✨Kerberos admin but make it a Perl module✨ and honestly? it ate.

🌸 NAME 🌸

Wallet::Kadmin::MIT — the Wallet Kerberos administration API, MIT flavor 🎀

✨ SYNOPSIS ✨

lowkey just look at it:

my $kadmin = Wallet::Kadmin::MIT->new;
$kadmin->create ('host/foo.example.com');
my $data = $kadmin->keytab_rekey ('host/foo.example.com',
                                  'aes256-cts-hmac-sha1-96');
$data = $kadmin->keytab ('host/foo.example.com');
my $exists = $kadmin->exists ('host/oldshell.example.com');
$kadmin->destroy ('host/oldshell.example.com') if $exists;

no cap, that's the whole vibe 💅

🦋 DESCRIPTION 🦋

so Wallet::Kadmin::MIT implements the Wallet::Kadmin API for MIT Kerberos, and it's the girl that handles creating and deleting principals and making keytabs. it provides the API documented in Wallet::Kadmin for an MIT Kerberos KDC. iconic behavior, truly.

now here's the tea ☕ — MIT Kerberos does not provide any method via the kadmin network protocol to retrieve a keytab for a principal without rekeying it. so the keytab() method (as opposed to keytab_rekey(), which does rekey the principal) is implemented using a remctl backend. for that method — the one used for unchanging keytab objects — to actually work, the necessary wallet configuration and remctl interface on the KDC have to be set up. no setup, no keytab, periodt. 😤

and to use this class at all? several configuration parameters must be set, bestie. go read "KEYTAB OBJECT CONFIGURATION" in Wallet::Config for the details. iykyk. 🫶

🎀 FILES 🎀

  • KEYTAB_TMP/keytab.<pid> — the keytab gets created in this file and then read into memory. KEYTAB_TMP is set in the wallet configuration, and <pid> is the process ID of the current process. after it's read, the file is unlinked. so it's like, here for a good time not a long time 💀

💀 LIMITATIONS 💀

ngl, currently this implementation calls an external kadmin program instead of using a native Perl module, which means it requires that kadmin be installed — and it parses its output. so yeah, it may miss some error conditions if the output of kadmin ever changes. fr fr, that's a real caveat, not me being dramatic. 😭

👑 SEE ALSO 👑

this module is part of the wallet system, and the current version is available from <https://www.eyrie.org/~eagle/software/wallet/>. go get her 🌈

🌟 AUTHORS 🌟

Russ Allbery <eagle@eyrie.org> and Jon Robertson <jonrober@stanford.edu>. absolute legends, we stan 💜

and that's the whole page, bestie!! 🌸 this was perl v5.40.0, dated 2024-11-12, from the Wallet...in::MIT(3pm) corner of the internet. mwah, slay, go configure your KDC 💅✨🦋

📦 where this page comes from