Re: choosing principal names
Booker Bense <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 6 Oct 2011, [email protected] wrote: > > Oh yes PAC, it is a way to use Kerberos to deliver more of verified data > than the mere principal name. > > May be it is what Booker Bense meant as an alternative to using > principal names for making authorization desicions. > Not at all, GSSAPI et al are just stop gap measures in which it is impossible to write a complete application. Just like kerberos provides a centralized authentication service, you need a centralized authorization and naming service. In an ideal world principals would simply be uuid's that provide a key to retrieving authorization and naming data. In the current world, using the principal as a key to perform an LDAP lookup is about as close as you can feasibly get. Embedding that ldap lookup in a PAC is just a performance hack. Until DCE is eventually reinvented in a form that actually works, there will continue to be a mishmash of hacks to bridge the missing pieces. Adding meaning to principal names simply encourages the same bad design, pretending they are content-free keys will at least move you in the correct direction. I get the point of the poor admin trying to actually build a working system with this stuff, but at some point you just have to accept that it's got limitations and move on. - Booker C. Bense