[23309] in Kerberos
RE: Kerberos for windows support in Mozilla
daemon@ATHENA.MIT.EDU (Tim Alsop)
Wed Feb 2 13:01:18 2005
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Date: Wed, 2 Feb 2005 18:00:14 -0000
Message-ID: <0D8F2EFD3A10E24DAEEA48EA6DA07D300A1FD4@postman-pat.csafe.local>
From: "Tim Alsop" <Tim.Alsop@CyberSafe.Ltd.UK>
To: "Douglas E. Engert" <deengert@anl.gov>,
"Wyllys Ingersoll" <wyllys.ingersoll@sun.com>, <kerberos@mit.edu>
Content-Transfer-Encoding: 8bit
Errors-To: kerberos-bounces@mit.edu
Douglas,
I would be interested to discuss with somebody the possibility of
Mozilla being able to use the CyberSafe GSS-API library on Windows as
well as the MIT GSS, and perhaps (for completeness) the Hiemdal GSS
library as well... From our perspective I can see a need for this
functionality - as you mentioned, sometimes the workstation does not
have access to AD, or is part of a non-Microsoft Kerberos realm etc.
Regards, Tim.
-----Original Message-----
From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On
Behalf Of Douglas E. Engert
Sent: 02 February 2005 17:46
To: Wyllys Ingersoll; 'kerberos@mit.edu'
Subject: Kerberos for windows support in Mozilla
Wyllys,
I saw your response to the bug report suggesting adding KfW support to
Mozilla for Windows.
https://bugzilla.mozilla.org/show_bug.cgi?id=280792
I think this would be a great idea, and people in the Kerberos community
would agree as well, and express their comments as well.
There are many windows machines that are not in a domain, or are on
travel and can not access the AD or are part of a Kerberos realm at all
yet the user would like to use Kerberos to access a web services.
These might even be now Windows servers that support SPNEGO line Apache.
Please reconsider your coments.
>
>
> Several applications like Vandyke Secure CRT allow the user to choose
> on Windows when they use gss-api Kerberos authentication whether they
> use the Windows SSPI or MIT Kerberos at runtime through configuration.
> I'm interested in Mozilla supporting this option as well. Would a
> sufficient number of people find this useful to include it? We should
> of course keep the default to SSPI for Windows platforms which support
it.
>
>
> ------- Additional Comment #1 From Wyllys Ingersoll 2005-02-02 08:33
> PST [reply] -------
>
> In order to support this, the host would have to already have the MIT
> Kerberos-For-Windows packages already installed.
Not really, the program checks for the existance of the dll.
>
> I think there is a very tiny percentage of sites that would find this
useful.
> I don't really know if this could be a run-time option, it would most
> likely have to be compiled at build time which makes it even less
attractive.
>
> I really don't see what the functional benefit would be. SSPI is
> integrated in Windows and is wire-compatible with GSSAPI applications.
> Where is the benefit to the end user of having mozilla use GSSAPI on
Windows instead of SSPI?
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
