Just wondering how you guys got it working ;) I notice the fowardable
tickets. I was wonder if I might investigate the ability to do
something
like the following:
1. Keep the primary TGT on the cosign server(s).
2. On an authorized RETR request, generate a TGT for THAT host and send
that.
I am not sure if this is do-able or not, but I am thinking of
investigating
this a little, because this will mean someone who compromises the web
server
will only be able to become these users from that host, which is
marginally
safer.
