At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in. For instance, my regular (login) principal might be called
foobar@DOMAIN, whereas my sudo principal is called
foobar/sudo@DOMAIN. In the past, we've met this requirement by building our own sudo with the
--enable-kerb5-instance=sudo flags set at build time. This means that our version of sudo hooks directly into kerberos, never using the PAM stack at all.
We're trying to see if we can meet the split-principal requirement without building and distributing our own build of sudo. My question is: Is this possible, and if so, how?
Using the standard RHEL 6/7 sudo package, I can't use the
--with-kerb5 build-time option; I have to use PAM as my authentication stack. That means I must use
pam_krb5, I've noticed that I can map usernames to principal names in
/etc/krb5.conf using the
appdefaults/pam/mappings configuration option. This gets me partway there, as it enables me to map a username of
foobar to a principal name of
foobar/sudo. However, from what I can tell, there's no way to set mappings per application (kerberos sees PAM as a single application, no matter which application is invoking the PAM stack), meaning the mapping applies to any applications that use
pam_krb5 in their PAM configuration. So I can get the system to use the sudo principals for both sudo and login, or login principals for both, but I can't get the system to use sudo principals for sudo and login principals for login.
Any ideas? Or am I stuck with having to build & distribute a custom sudo?