| Newsgroups |
gmane.comp.encryption.kerberos.heimdal.general |
| Message-ID |
<[email protected]> |
On Wed, Oct 05, 2011 at 01:09:18PM -0500, Nico Williams wrote:
> - there's also GSS_C_NT_DOMAINBASED__SERVICE, but most of you
> aren't going to be using it
With all appreciation for your explanations Nico, I can not help
noting that GSS_C_NT_DOMAINBASED_SERVICE is there for a reason (to cover
deficiencies in former versions of the standard and e.g. allow the quite
broken nfs4 design to finally adopt domain-based namespace).
One might otherwise easily feel that GSS_C_NT_DOMAINBASED_SERVICE is
exotic and is nothing to care of. It is exotic because the standard was
limited (I would say broken) from the beginning. Domain based services
are actually more of "the right thing" compared to server based ones.
> Authorization should generally be done on the basis of:
>
> - gss_export_name() tokens compared (or looked up) byte-wise
> - gss_display_name() strings (and name type) compared like strings
> (this is not guaranteed to work well for every mechanism, so it's not
> advisable -- it will work for Kerberos, however)
> - name attributes (SIDs from the PAC, etc...)
Oh yes PAC, it is a way to use Kerberos to deliver more of verified data
than the mere principal name.
May be it is what Booker Bense meant as an alternative to using
principal names for making authorization desicions.
Well, this can be done but this just moves the problem of structure design
and interpretation from the principal name strings to PAC data. I'd go
with strings - this is pretty general (as much as PAC) and does not place
extra data into the Kerberos infrastructure (thus keeping authentication
and authorization apart as much as possible).
> So that the totality of the authorization context can be a bit more
> than the client principal's name and credentials might otherwise imply
> without any additional context (context, here, includes such things as
> share options).
If e.g. the additional information to an NFS server implies group
membership for the client identity, then it means that the identity
server (e.g. Kerberos) has the knowledge about the groups applicable to
the data on this file server's disks.
This _can_ be a useful approach but it implies centrally managed
setups where both the Kerberos service and the service using Kerberos
are managed together quite tightly. This corresponds to a large class of
Kerberos deployments (sites using AD as an example) but is not the same
as the set of useful/desirable setups. Probably neither its strict subset :)
Regards,
Rune