[5013] in Kerberos
Re: Q: K4 app-srvr->app-srvr authentication?
daemon@ATHENA.MIT.EDU (Theodore Ts'o)
Fri Apr 21 14:40:08 1995
Date: Fri, 21 Apr 1995 14:26:25 +0500
From: Theodore Ts'o <tytso@MIT.EDU>
To: fluder@Merck.Com
Cc: kerberos@MIT.EDU
In-Reply-To: Fluder's message of 21 Apr 1995 06:15:28 -0500,
<9504211120.AA23167@igw.merck.com>
Date: 21 Apr 1995 06:15:28 -0500
From: fluder@Merck.Com (Fluder)
I am working on an application that has two servers which will
periodically need to talk to each other. We are prototyping it using
K4. The client/server authentication was no problem, but it is not
obvious (yet) how one application server can authenticate itself to
another since it does not have a tgt_file, only a srvtab. It does not
seem that I can simply use the krb_sendauth/recvauth pair.
Using either Kerberos V4 or V5, it is possible to use a srvtab to
request ticket-granting-tickets in the name of the server. Clients and
server principals share the same namespace, and a DES key in the
server's srvtab file is functionally identical to a user's password
after it has been turned into a key using the string_to_key function.
The ksrvutil program under K4 will provide the functionality that you're
looking for.
- Ted
