[18957] in Kerberos_V5_Development
Re: How often does MIT krb5 request for KDC info through DNS?
daemon@ATHENA.MIT.EDU (Weijun Wang)
Tue Aug 5 21:17:16 2014
Message-ID: <53E18205.2030601@oracle.com>
Date: Wed, 06 Aug 2014 09:16:53 +0800
From: Weijun Wang <weijun.wang@oracle.com>
MIME-Version: 1.0
To: Nico Williams <nico@cryptonector.com>
In-Reply-To: <20140805155340.GB23175@localhost>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 8/5/2014 23:53, Nico Williams wrote:
> On Tue, Aug 05, 2014 at 03:38:28PM +0800, Weijun Wang wrote:
>> I wonder if it's easy to set up such a service. Here we are talking
>> about the client side, which might be just a browser talking HTTP
>> with "Windows Integrated Authentication".
>
> Modern/decent OSes just have it, at least as an option. You'll have to
> read the docs.
>
> As for JGSS performance, there are worse problems:
>
> - non-caching of some tickets
I agree.
>
> - delegating credentials by default in the HTTP/Negotiate stack
> (forwarded tickets are generally not cached on the client side)
Now that Java has constrained delegation, will re-consider this.
>
> - doing an HTTP request w/o authentication every time, thus getting a
> 401 then trying again with Kerberos
I'll ask the networking team.
>
> - servlets that don't use cookies to optimize away the GSS context
> setup per-request(!!!)
I'll forward this to people knowing about servlets.
Thanks
Max
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
