[30125] in Kerberos
Re: SSO
daemon@ATHENA.MIT.EDU (Simon Wilkinson)
Fri Jul 18 11:22:08 2008
In-Reply-To: <78c6bd860807180734j47060eeaq3aea141fb38314ef@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v753)
Message-Id: <550CD656-0363-4100-81B5-A1B422B1BFFD@sxw.org.uk>
From: Simon Wilkinson <simon@sxw.org.uk>
Date: Fri, 18 Jul 2008 16:05:24 +0100
To: Michael B Allen <ioplex@gmail.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 18 Jul 2008, at 15:34, Michael B Allen wrote:
>
> As stated before this is completely false. These browser configuration
> options accept a domain name which makes all the configs the same.
Given that I wrote portions of this code, I'm entirely aware of what
it can, and can't do. In situations where the KDC provides no control
over delegation, you do not want every machine in your domain capable
of accepting delegated credentials. The fact that the Firefox switch
controls not just SPNEGO, but also NTLM authentication, means you
have to be additionally cautious if you have a site with machines
under multiple different managements under the same control.
> You
> do not need to specify explicit hostnames. AD will not give services
> TGTs unless the service account is flagged as "Trusted for
> delegation"
Not all KDCs implement this functionality. Not all sites use AD. The
original poster explicitly " ... does not want to use AD in any
solution".
While I'm here, I should also respond to:
> Then you have "SSO" solutions like OpenID which are really more like
> "triple sign on" since you have to login to your workstation, then to
> the OpenID service and then put in the OpenID service you're using at
> the target site.
This is not true. You can implement an OpenID solution which
leverages your site's local authentication and a WebSSO mechanism
such as Cosign, to allow single sign-on to appropriate OpenID
services too (removing the final signon step requires that the
service remember the OpenID you used when you last accessed the
site). We have such a service in development.
S.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
