Re: choosing principal names
Russ Allbery <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Organization | The Eyrie |
| Message-ID | <[email protected]> |
Nico Williams <[email protected]> writes: > It's a very good performance optimization, first of all, but also it's > good for privacy: the issuer can change the PAC contents according not > just to who is the client principal, but also according to who is the > service principal (or what realm you transit to/through). You can do that even better, and more flexibly, with LDAP, and have the additional advantage that LDAP updates immediately whereas the PAC is created at the issuance of the ticket and then doesn't change. I think LDAP lookups are superior to the PAC in every possible respect except for performance and the requirement to contact a central service (PAC data can work in a more decoupled network environment). -- Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/>