From:	MERC::"uunet!CRVAX.SRI.COM!RELAY-INFO-VAX" 20-OCT-1992 03:46:11.76
To:	info-vax@kl.sri.com
CC:	
Subj:	KERBEROS:  Use of $CREPRC



	Hello again,

	Earlier, I was tinkering around with a program that issues the
$CREPRC system service.  It has the flags set to make a detached process,
and to create the process using the username of the issuer.

	Well, if you go into kernel mode and trace your way to your
process' JIB, there's a field there that houses your username.  You change
that field to be the username of target process, exit from kernel mode,
issue the $CREPRC, and Viola!  You have an interactive or detached process
running under the desired username.

	It seems to me that the job of implementing Kerberos under VMS
may be much easier than we first thought.  I thought that maybe we would
have to rewrite LOGINOUT, but that does not appear to be the case.

	Obviously, more has to be done than just changing that one field.
I would assume that all the PCB, JIB, etc fields should be updated, much
like taking the shell process and filling in the blanks.

	That could also provide a usefulness for SYSUAF in a Kerberized
system.  Namely, every time KERBY_LOGINOUT gets an authenticated name from
the authentication server, it writes/updates that username into SYSUAF
before issuing the $CREPRC.

	Anyone wish to comment on this?


-- 
Bill Laut			Internet:  laut@alien.gici.com
Gull Island Consultants, Inc.	Phone:     (616) 780-3321
Muskegon, MI  49440		>> "Usual disclaimers, apply within" <<

"Praise the Lord from the earth, ye dragons and all deeps."   Psalm 148:7