[15796] in Kerberos_V5_Development
Re: a suggestion for improving pkinit preauth plugin token choosing
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Wed May 12 11:00:21 2010
Message-ID: <4BEAC26B.6040000@anl.gov>
Date: Wed, 12 May 2010 09:59:55 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Sam Hartman <hartmans@mit.edu>
In-Reply-To: <tslbpcl5ldk.fsf@mit.edu>
Cc: "Henry B. Hotz" <hotz@jpl.nasa.gov>, "krbdev@mit.edu" <krbdev@mit.edu>,
Nicolas Williams <nicolas.williams@oracle.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Sam Hartman wrote:
> I actually agree with henry that "please insert a token," should be out
> of scope for preauth plugins.
> My rationale is that the current prompter interface is kind of weak when
> it interacts with GUIs etc, and the more we can avoid using it, the
> better.
>
> For example, what should that prompt read? "Press enter," may be right
> for a CLI instance, but will be wrongish for gdm.
>
> I suspect Henry and I may be in the rough on this point.
I play a lot from the rough, and I agree with both of you.
Its the current PAM architecture that is weak. Pam needs a better front
end to give the user some choices, and a better way to propagate those
choices to the individual PAM modules.
> _______________________________________________
> krbdev mailing list krbdev@mit.edu
> https://mailman.mit.edu/mailman/listinfo/krbdev
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
