[1725] in Kerberos
Re: Management and Kerberos
daemon@ATHENA.MIT.EDU (Jon A. Rochlis)
Fri Jan 17 12:16:50 1992
From: jon@MIT.EDU (Jon A. Rochlis)
To: pato@apollo.com (Joe Pato)
Cc: lunt@ctt.bellcore.com (Steve Lunt), tardo@nac.enet.dec.com,
In-Reply-To: Your message of Thu, 16 Jan 92 13:59:22 -0500.
Date: Fri, 17 Jan 92 10:14:46 GMT
The DCE implementation of Kerberos V5 needs neither the krb.conf nor
krb.realm file. Each DCE node contains a single DCE configuration file that
identifies the cell name (aka realm name) for the machine and the local
machine's principal name. All other locating information is obtained from the
global/cell name system. The name system does not need to be trusted - the KDC
is verified by the local machine since it is a principal and only shares its
key with legitimate KDCs.
Joe, 2 questions:
1) What does "local machine's principal name" mean? Does DCE require
each client *machine* to have an authentication identity?
2) How do you do the service name to realm name mapping? This is the
one case that you can't ask a non-trusted name service, because you
can then be fooled into getting tickets for the wrong realm (which
could work just fine). Steve Kent pointed this one out quite a while
ago.
-- Jon
