[15803] in Kerberos_V5_Development
Re: a suggestion for improving pkinit preauth plugin token choosing
daemon@ATHENA.MIT.EDU (Simo Sorce)
Wed May 12 13:41:01 2010
Date: Wed, 12 May 2010 13:40:56 -0400
From: Simo Sorce <ssorce@redhat.com>
To: krbdev@mit.edu
Message-ID: <20100512134056.4a270974@willson.li.ssimo.org>
In-Reply-To: <20100512155031.GZ9429@oracle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, 12 May 2010 10:50:33 -0500
Nicolas Williams <Nicolas.Williams@oracle.com> wrote:
> Second, this is a problem for PAM as well, and there there's no easy
> fix. PAM and gic are the interfaces that we've got, I'm afraid.
> Giving up on doing the best we can with the interface we have because
> we can't get it to be perfect seems wrong to me; taking a detour to
> extend PAM would be wrong as well as that'd be a huge project.
Although fixing PAM is not in scope here, I would hope that the
interface can be chosen in a way that will not make it cumbersome to
use if someone comes up with something better than PAM in the future.
PAM is really a problem and I wouldn't be surprised to see
alternatives cropping out soon.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
