[8053] in Kerberos
Re: Kerberos in Java
daemon@ATHENA.MIT.EDU (Doug Engert)
Thu Sep 19 15:00:34 1996
Date: Thu, 19 Sep 1996 13:38:20 -0500
From: Doug Engert <DEEngert@anl.gov>
To: jaynes@umich.edu
Cc: kerberos@MIT.EDU
In-Reply-To: <32417688.6EF5@umich.edu>
William Jaynes writes:
> Doug Engert wrote:
> >
> > William Jaynes writes:
> > > Has anyone developed a Java class to do Kerberos authentication? I'm
> > > developing server-side Java web applications and I could use something
> > > pretty simplistic, that takes an id and passwd and simply returns
> > > whether the password is good.
> >
> > Why, as a user, would I trust a Java application with my Kerberos
> > userid and password? I might trust yours, but if users get in the
> > habit of giving their password to java applications, someone else
> > might WILL along and write one which looks like yours, i.e. a Trojan
> > horse. You really don't ever want to send you kerberos password over
> > the net.
>
> Well, for that matter why ever type in your password at all, ever? You
> might be giving it to some Trojan horse? Don't use it and you'll keep it
> safe.
I realize that you are being facetious with this remark, but you have
hit on the heart of the mater. Eventual I would like to see a smart
cards used in place of the password i.e. there is no password.
But a crucial step in implementing smart-cards for authentication is
the removal of reliance of sending passwords over the network. The
authentication must be done at the user's workstation. When we get to
the point of only entering and using the password on the workstation
it will be any easy change to replace the password authentication with
the smart-card authentication. The remote authentication is handled by
Kerberos.
> Seriously, if I want to develop a web application to be accessed
> using any good browser, I want to do user authentication, and the
> id/password is in a Kerberos server, then what are my options?
The idea would be to authenticate on the workstation using Kerberos
for example, and have the browser request a ticket for the web
server. The NCSA Mosaic has a K5/DCE/AFS/K4 authentication capability.
Since only NCSA has picked up on Kerberos based authentication and not
Netscape or Microsoft, and since most people don't want to change
browsers just for the security, another approach is to use a secure
web proxy agent which runs on the user's workstation which does the
authentication and transfer of data.
The Gradient Technologies' Web Crusader (http://www.gradient.com) and
the Dascom product (http://www.cplabs.com) are based on the OSF DCE
Web technologies. (http://www.osf.org/www/dceweb) This technology uses
the secure local proxy on the workstation. It does authentication and
authorization via DCE. I understand some code is available. See the
OSF reference above.
And since DCE uses Kerberos 5, and the Kerberos clients can use a DCE
security server as the KDC, this appears to be a win-win situation.
> Not much. The web server has to act as proxy for the user. My users will
> connect to my web server using SSL, so at least everything is encrypted.
Its not much, but it is a start. It sounds like a lot of work to
avoid sneding the password over the network, even if it it is done
using SSL. But it the long run, I believe it will payoff.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
