lament/pantheon

a kadmin/krb-tui toolkit, and ldap-tui gets its own scoped admin bind #116

Merged

lament merged 3 commits from feat into main

2026-07-27 17:14:19 -05:00

lament commented

2026-07-27 17:10:01 -05:00

Owner

just kadmin/princ-* recipes for Kerberos principal management from ishtar, over the network - listprincs/getprinc/addprinc/modprinc/delprinc, parsed into nu tables/records
- can't ride the desktop-SSO TGT: kadmin/admin/kadmin/changepw are protected principals the KDC only derives via a direct AS-REQ ("TGT BASED NOT ALLOWED" regardless of kadm5.acl), so just kadmin pre-fetches that ticket once into its own ccache (admin_ccache) rather than evicting the login TGT ssh/SPNEGO depend on
krb-tui: an fzf front-end over the same kadmin surface, packaged fleet-wide (modules/packages.nix)
- self-authenticates into its own ccache the same way, adds expire/policy/delete actions and a getprinc preview pane
- policy-add recipe + kdc.nix's new default_pwd_policy give every future principal a default password policy (history 3, 90-day max life) - existing principals don't retroactively pick it up, attach by hand with princ-policy
svcLdapAdmin@LAMENT.GAY: a new Kerberos principal for ldap-tui's admin-capable LDAP bind
- openldap.nix's olcAccess gets two new subtree-scoped rules ahead of the catch-all, granting cn=svcLdapAdmin write on ou=people/ou=groups only - cn=config and cn=krbContainer stay out of reach, no cn=admin-equivalent handed out
- same {SASL}princ pointer pattern as uid=lament - no password ever lands in LDAP, saslauthd verifies binds straight against the KDC
- princ-svc-add: new recipe mints a password-bind principal (kadmin -pw, not -randkey - there's nothing to extract into a keytab here) and stashes the password into sops/<file>.yaml
- sops/extra.yaml (new): kept separate from the fleet-wide categories on purpose, decryptable by lament + ishtar only - this credential is consumed locally where ldap-tui runs, never deployed to a service host
niri: Mod+Shift+P opens noctalia's session/power panel; jj's revsets.log bumped to 10 generations back (jj's own default only showed 2)

left for later: ldap-tui itself isn't wired up yet - svcLdapAdmin's password lives in sops/extra.yaml, consuming it into the TUI's own config is a separate step.

- `just kadmin`/`princ-*` recipes for Kerberos principal management from `ishtar`, over the network - `listprincs`/`getprinc`/`addprinc`/`modprinc`/`delprinc`, parsed into nu tables/records - can't ride the desktop-SSO TGT: `kadmin/admin`/`kadmin/changepw` are protected principals the KDC only derives via a direct AS-REQ ("TGT BASED NOT ALLOWED" regardless of `kadm5.acl`), so `just kadmin` pre-fetches that ticket once into its own ccache (`admin_ccache`) rather than evicting the login TGT ssh/SPNEGO depend on - `krb-tui`: an fzf front-end over the same `kadmin` surface, packaged fleet-wide (`modules/packages.nix`) - self-authenticates into its own ccache the same way, adds `expire`/`policy`/`delete` actions and a `getprinc` preview pane - `policy-add` recipe + `kdc.nix`'s new `default_pwd_policy` give every future principal a default password policy (history 3, 90-day max life) - existing principals don't retroactively pick it up, attach by hand with `princ-policy` - `svcLdapAdmin@LAMENT.GAY`: a new Kerberos principal for `ldap-tui`'s admin-capable LDAP bind - `openldap.nix`'s `olcAccess` gets two new subtree-scoped rules ahead of the catch-all, granting `cn=svcLdapAdmin` write on `ou=people`/`ou=groups` only - `cn=config` and `cn=krbContainer` stay out of reach, no `cn=admin`-equivalent handed out - same `{SASL}princ` pointer pattern as `uid=lament` - no password ever lands in LDAP, `saslauthd` verifies binds straight against the KDC - `princ-svc-add`: new recipe mints a password-bind principal (`kadmin -pw`, not `-randkey` - there's nothing to extract into a keytab here) and stashes the password into `sops/<file>.yaml` - `sops/extra.yaml` (new): kept separate from the fleet-wide categories on purpose, decryptable by `lament` + `ishtar` only - this credential is consumed locally where `ldap-tui` runs, never deployed to a service host - niri: `Mod+Shift+P` opens noctalia's session/power panel; `jj`'s `revsets.log` bumped to 10 generations back (jj's own default only showed 2) left for later: `ldap-tui` itself isn't wired up yet - `svcLdapAdmin`'s password lives in `sops/extra.yaml`, consuming it into the TUI's own config is a separate step.

lament added 3 commits

2026-07-27 17:10:01 -05:00

back to ishtar for a moment b566b8e85c

kadmin recipes for principal management from ishtar, over the network 985f42ff6a

scope an admin ldap bind (svcLdapAdmin) to people/groups only

CI / check (pull_request) Successful in 56s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m24s

Details

CI / dry-activate (pull_request) Successful in 31s