[39372] in Kerberos
Re: Looking for a "Kerberos Router"?
daemon@ATHENA.MIT.EDU (Ken Hornstein via Kerberos)
Wed Mar 13 10:53:37 2024
Message-Id: <202403131452.42DEqTwP016604@hedwig.cmf.nrl.navy.mil>
To: Yoann Gini <yoann.gini@gmail.com>
cc: kerberos@mit.edu
In-Reply-To: <581276BD-9D29-4D8C-A23E-8613493E378B@gmail.com>
MIME-Version: 1.0
Date: Wed, 13 Mar 2024 10:52:29 -0400
From: Ken Hornstein via Kerberos <kerberos@mit.edu>
Reply-To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
>> One thing that leaps out at me is that by default a lot of Kerberos
>> messages default to UDP transport so that might be a bit trickier to
>> proxy them (but not impossible).
>
>Yes, that's another aspect of the issue, our expectations so far are on
>support for TCP only clients. Since it's for mobile users that we are
>looking to have this support, it shouldn't be an issue.
I would caution you that I think that is something you're going to have
to grapple with much sooner than you think.
A long time ago we had developed a small Kerberos proxy that forwarded
on Kerberos messages by prepending the source IP address/port to the
UDP message (our KDC at the time was modified to recognize this
and sent the prepended bytes back to the proxy so it could send it to
the correct originator).
--Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
