[23301] in Kerberos
Re: Firefox on Linux/UNIX and mutual authentication
daemon@ATHENA.MIT.EDU (Wyllys Ingersoll)
Tue Feb 1 16:29:56 2005
Message-ID: <41FFF494.9020308@sun.com>
Date: Tue, 01 Feb 2005 16:28:52 -0500
From: Wyllys Ingersoll <wyllys.ingersoll@sun.com>
MIME-Version: 1.0
To: Frank Balluffi <frank.balluffi@db.com>
In-Reply-To: <OF836976CD.8D8FEBE4-ON85256F9A.006C660F-85256F9A.006D6815@db.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Frank Balluffi wrote:
>My investigation shows that Firefox on Windows (which uses Microsoft SSPI)
>sends RFC 2478 SPNEGO tokens with the mutual-required flag on and Firefox
>on Linux/UNIX (which uses GSSAPI) sends RFC 1964 Kerberos tokens with the
>mutual-required flag off.
>
>Can anyone think of a reason why Firefox on Linux/UNIX should not set the
>mutual-required flag on? Thanks.
>
>
Because the HTTP protocol does not support the use of mutual authentication.
Microsoft "broke" the HTTP standard in order to support mutual auth by
adding
extra data to the "200 OK" response that the IIS server returns after it
authenticates
the client's Kerberos creds (SSPI). The Mozilla developers did not
want to pollute
the core HTTP protocol engine with special case code to handle the extra
data that
might be associated with a mutual-auth GSSAPI response, so they chose to
ignore it.
Because mutual auth is not possible at this time, it is strongly
recommended that
any Linux/Apache installation that implements GSSAPI authentication
(e.g. mod_auth_kerb)
also use SSL to encrypt the authentication exchange. The default
settings in
Firefox/Mozilla are to only respond to the "Negotiate" request when the
URL is
"https", though this can be overridden by the user.
-Wyllys
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
