[35759] in Kerberos
Re: Challenging clients, why another ping-pong?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Thu Feb 6 14:01:32 2014
From: Russ Allbery <eagle@eyrie.org>
To: "kerberos\@mit.edu" <kerberos@mit.edu>
In-Reply-To: <59CBC55C-B665-491A-94DD-4DBC18696DAE@openfortress.nl> (Rick van
Rein's message of "Thu, 6 Feb 2014 17:57:04 +0100")
Date: Thu, 06 Feb 2014 11:00:38 -0800
Message-ID: <87ob2km5gp.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Rick van Rein <rick@openfortress.nl> writes:
> Thanks, the terminology has indeed been confusing to me. I suppose
> things are as they are — or, as they have grown.
The short but less polite version is that HTTP-Negotiate with SPNEGO is a
horrible hack from a Kerberos perspective. It sort of works as long as
you know what to expect from it, but it's basically a half-assed one-sided
authentication from the client to the server that doesn't behave like a
real GSS-API authentication, doesn't give you mutual authentication or
most of the other GSS-API guarantees, and cannot scale to other mechanisms
or to sensible changes in how one wants the negotiation to work.
Most of those problems are inherent in the way that it was plugged into
HTTP and cannot easily be fixed.
Since HTTP doesn't provide any easy way for an authentication mechanism to
add channel encryption, any proper solution is probably stuck with channel
binding and using TLS for confidentiality. But within that constraint,
it's probably possible to do better by taking the authentication out of
the HTTP headers into, say, a separate exchange with different HTTP
protocol verbs or with designated URLs, resulting in some sort of
authenticator with channel bindings that must be provided in all
subsequent HTTP requests in that session. Nico has done some work on such
a protocol.
--
Russ Allbery (eagle@eyrie.org) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
