[33633] in Kerberos
Re: threading best practices?
daemon@ATHENA.MIT.EDU (Luke Howard)
Sat Jul 23 07:03:08 2011
Mime-Version: 1.0 (Apple Message framework v1244.3)
From: Luke Howard <lukeh@padl.com>
In-Reply-To: <CAK3OfOjgiooOi9kTLuXPRwbb+FR8MKkKn909cpk0eNQq70fmoA@mail.gmail.com>
Date: Sat, 23 Jul 2011 11:02:56 +0000
Message-Id: <11594264-8AD5-407E-979F-CB18DAE225FC@padl.com>
To: Nico Williams <nico@cryptonector.com>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 23/07/2011, at 12:22 AM, Nico Williams wrote:
> On Fri, Jul 22, 2011 at 7:04 PM, Greg Hudson <ghudson@mit.edu> wrote:
>> On Fri, 2011-07-22 at 18:10 -0400, Nico Williams wrote:
>>> Why are you not using the GSS-API?
>>
>> Chris started out by asking about user-to-user auth, so I didn't
>> redirect him to GSSAPI since, as far as I know, GSSAPI doesn't have a
>> story there (for the krb5 mech, at least).
>
> Indeed, the krb5 mech has no story here. I'm thinking we should have
> the initiator send a bogus AP-REQ with a new auth-options flag. If
> the server understands it it would respond with a KRB-ERROR with the
> TGT in the e-data, else with a plain KRB-ERROR.
Hasn't draft-swift-win2k-krb-user2user-03 been shipping since Windows 2000?
-- Luke
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
