Re: Current semantics for channel-bindings in GSSAPI

Stefan Metzmacher <[email protected]> Tue, 10 Mar 2020 16:23:35 +0100

Newsgroups	gmane.comp.encryption.kerberos.devel
Message-ID	<[email protected]>

Hi Issac,

> As discussed last week, we want the following changes.
> 
> - MIT should match Heimdal behavior and only error if client bindings
> are not all zeros.
> - Both Heimdal/MIT should return channel-bound flag if the bindings did match.
> - Both Heimdal/MIT should take advantage of KERB_AP_OPTIONS_CBT if
> present if authenticator, in which case if the server passed bindings
> they must match.
> - Both Heimdal/MIT should provide a conf option to asset the client
> system supports channel-bindings, causing KERB_AP_OPTIONS_CBT to be
> sent in any ap-req.
> 
> I submitted wip PR #1047 upstream MIT based on the above.
> 
> @metze, would that satisfy samba's requirements?

I looked briefly and the core changes look good,
but (as always :-) I think krb5.conf option alone are unflexible
and I'd really like to get rid of autogenerated krb5.conf files and
global exporting "KRB5_CONFIG". So APIs to turn this on from the
application would be great.

metze

_______________________________________________
krbdev mailing list             [email protected]
https://mailman.mit.edu/mailman/listinfo/krbdev

signature.asc (application/pgp-signature, 833 B)