[5021] in Kerberos
Re: Q: K4 app-srvr->app-srvr authentication?
daemon@ATHENA.MIT.EDU (Asokan)
Sat Apr 22 15:54:00 1995
To: kerberos@MIT.EDU
Date: Sat, 22 Apr 1995 15:54:24 GMT
From: nasokan@math.uwaterloo.ca (Asokan)
In article <9504211826.AA23971@dcl.mit.edu>,
Theodore Ts'o <tytso@MIT.EDU> wrote:
> Date: 21 Apr 1995 06:15:28 -0500
> From: fluder@Merck.Com (Fluder)
>
> I am working on an application that has two servers which will
> periodically need to talk to each other. We are prototyping it using
> K4. The client/server authentication was no problem, but it is not
> obvious (yet) how one application server can authenticate itself to
> another since it does not have a tgt_file, only a srvtab. It does not
> seem that I can simply use the krb_sendauth/recvauth pair.
>
>Using either Kerberos V4 or V5, it is possible to use a srvtab to
>request ticket-granting-tickets in the name of the server. Clients and
>server principals share the same namespace, and a DES key in the
>server's srvtab file is functionally identical to a user's password
>after it has been turned into a key using the string_to_key function.
>
>The ksrvutil program under K4 will provide the functionality that you're
>looking for.
>
> - Ted
The ksrvtgt command under K4 can be used to get a tgt using a key
in a srvtab. ksrvtgt is somewhat restrictive but the code is
trivial to modify to make it more flexible (I have, in case someone
is interested).
- Asokan
University of Waterloo
