I have a system account in my domain (DOM\sys
) and it has access to service cifs/server@DOM
. I want to obtain a ticket for this service using my own account (DOM\user
). In other words I need sudo-like mechanism for kerberos - to obtain sys
'es ticket without using his password. My flow would be:
- obtain TGT for
user
- using this TGT obtain ticket to
cifs/server@DOM
forsys
- now
user
can talk toserver
on behalf ofsys
I searched for delegation / impersonation in kerberos, and found something, but it seems it isn't what I need (it "forwards" the identity proof, but still requires sys
to provide password)
It looks like ksu is similar to what I need, but it works only for access to local account (here, second bullet)