[18994] in Kerberos_V5_Development
Re: Multi-round trip extension
daemon@ATHENA.MIT.EDU (Nico Williams)
Tue Sep 2 12:03:38 2014
MIME-Version: 1.0
In-Reply-To: <1409661578.14731.2.camel@willson.usersys.redhat.com>
Date: Tue, 2 Sep 2014 11:03:24 -0500
Message-ID: <CAK3OfOhsqnTxv5dq-X7y3HxzVYwtWbcUOX3mZUc3MPMkT70vYw@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Simo Sorce <simo@redhat.com>
Cc: "heimdal-discuss@sics.se" <heimdal-discuss@sics.se>,
"krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Sep 2, 2014 at 7:39 AM, Simo Sorce <simo@redhat.com> wrote:
> Well, it depends, my mod_auth_gssapi supports keeping auth tied to a
> connection, and both Internet Explorer and Firefox oblige and keep the
> whole exchange on the same connection. In fact NTLMSSP authentication (2
> full roundtrips) works in this mode.
Sure. But what about proxies? What about many other HTTP clients and
servers? (libcurl? nginx? node this or that, various Java classes,
...).
> It is not too hard to set a cookie and keep state (export partially
> established context and store it in some local cache) in the server
> either, though sending the state to the client might make it work across
> balancing servers that do not keep a client connected to the same server
> between any 2 exchanges, not sure it is worth dealing with those cases
> though. I haven't yet fully investigated the case of proxies.
Cookies are not required to implement by clients. To maximize interop
a server would have to be prepared to use both, cookies and
per-connection state.
> In MIT code exporting partially established context works in recent
> versions.
Which is good. I mentioned the non-standard aspect of this because
that's come up a lot before.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
