[22611] in Kerberos
Re: Heimdal or MIT kerberos
daemon@ATHENA.MIT.EDU (Henry B. Hotz)
Mon Oct 4 15:12:50 2004
In-Reply-To: <200410041602.i94G2NZZ017088@pch.mit.edu>
Mime-Version: 1.0 (Apple Message framework v619)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <24231064-1639-11D9-A2CB-000A95CA746C@oxy.edu>
Content-Transfer-Encoding: 7bit
From: "Henry B. Hotz" <hbhotz@oxy.edu>
Date: Mon, 4 Oct 2004 12:11:05 -0700
To: kerberos@mit.edu, samwun@hgcbroadband.com
cc: fcusack@fcusack.com
Errors-To: kerberos-bounces@mit.edu
On Oct 4, 2004, at 9:02 AM, kerberos-request@mit.edu wrote:
> Date: Sun, 03 Oct 2004 22:40:50 -0700
> From: Frank Cusack <fcusack@fcusack.com>
> To: kerberos@MIT.EDU
> Subject: Re: Heimdal or MIT kerberos
> Message-ID: <m3ekkfvy59.fsf@magma.savecore.net>
> References: <cjqfj4$1rss$1@news.hgc.com.hk>
> Precedence: list
> Message: 2
>
> On Mon, 04 Oct 2004 10:55:49 +0800 sam <samwun@hgcbroadband.com> wrote:
>> I m not sure which kerberos I should use.
They're both good. Don't sweat it too much.
> Heimdal does not have a functioning replay cache, so if your app
> needs that you must go with MIT.
Very true, but it depends on the app whether it matters or not.
Heimdal doesn't support password history checking either, but there's
public code to add that if you don't run a very large site.
> Apache kerberization is a long hard road. You're much better off
> going with pubcookie or some such system.
> http://middleware.internet2.edu/webiso/ is a good page that
> points to lots of web sso software.
Hmmm. If you use a recent Mozilla-derivative and mod_auth_kerb with
Apache it seems to handle the basics. Haven't checked interop with MS
products.
Which one you choose may depend on whether you need some add-on. There
are a couple of hardware pre-authentication devices supported only with
MIT patches, but the PKINIT patches are only for Heimdal.
------------------------------------------------------------------------
----
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
