[22795] in Kerberos
Re: KfW Integrated Logon
daemon@ATHENA.MIT.EDU (Sensei)
Mon Nov 1 15:27:12 2004
From: Sensei <senseiwa@tin.it>
Date: Sat, 30 Oct 2004 12:36:02 +0200
Message-ID: <2uh958F2aue2hU1@uni-berlin.de>
To: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Jeffrey Altman wrote:
> When OpenAFS is used on Windows and the user account stores the
> Windows Profile in the AFS file system there is a requirement that
> the AFS Client Service (afs file system client) possess the Kerberos
> based AFS authentication token prior to the moment that Windows
> attempts to read the profile out of the file system. This is
> performed by installing a Network Provider module into the Windows
> Login process. The Network Provider is given access to the user's
> name and password so that the necessary credentials can be obtained
> prior to the creation of the Logon Session for the user. Creating
> the Logon Session requires access to the Windows Profile for the
> user.
Well, I've been wandering about implementing a real integrated logon,
and it seems that what you're stating does not work so easily (at my
knowledge, it won't work).
It's possible to have windows authenticate to a kdc. OpenAFS gets the
right ticket and token after the authentication. Anyway, a local profile
it's still needed to create a login, since the profile isn't readable
while windows logs on.
Are you saying that you succeeded in making windows use an external kdc
to authenticate, storing windows profiles on the user's volume? All this
things without creating a local profile for each user (principal) and
without using AD in X-realm? If so, how did you get that? Samba in some
weird mode? Ldap?
--
Sensei <mailto:senseiwa@tin.it> <pgp:8998A2DB>
The optimist says "Tomorrow is sunday".
The pessimist says "The day after tomorrow's monday". (Gustave Flaubert)
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
