[18948] in Kerberos_V5_Development
Re: How often does MIT krb5 request for KDC info through DNS?
daemon@ATHENA.MIT.EDU (Nico Williams)
Tue Aug 5 12:16:53 2014
Date: Tue, 5 Aug 2014 11:16:41 -0500
From: Nico Williams <nico@cryptonector.com>
To: David Woodhouse <dwmw2@infradead.org>
Message-ID: <20140805161640.GC23175@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <1407254620.28796.31.camel@infradead.org>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Aug 05, 2014 at 05:03:40PM +0100, David Woodhouse wrote:
> On Tue, 2014-08-05 at 10:53 -0500, Nico Williams wrote:
> > As for JGSS performance, there are worse problems:
> >
> > - servlets that don't use cookies to optimize away the GSS context
> > setup per-request(!!!)
>
> - On IIS, failing to set the 'AuthPersistNonNTLM' attribute which makes
> Kerberos authentication a per-connection thing instead of per-request
HTTP/1.1 is not supposed to be aware of connection state, and IIRC the
servlet interface design doesn't make it possible to make the servlet
able to cache per-connection state :(
Cookies are teh authentication state system for HTTP, for better or
worse, whether we like it or not.
Java needs an utterly trivial-to-setup session cookie system.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
