[24915] in Kerberos
Re: Kerberos referrals
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Thu Nov 10 02:00:48 2005
In-Reply-To: <20051110051943.GB17782@mlserv.jaist.ac.jp>
Mime-Version: 1.0 (Apple Message framework v746.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <E18E1142-16D3-46F8-B837-4620BDC1931A@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Wed, 9 Nov 2005 22:56:25 -0800
To: Saber Zrelli <zrelli@jaist.ac.jp>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Nov 9, 2005, at 21:19, Saber Zrelli wrote:
> I read this draft and I am trying to understand how referrals work.
>
> In section 8. "Cross realm routingi", It is said that for server
> referrals, the KDC takes in charge the optimization of the referral
> path because it has more information about cross-realm routing.
>
> Does this mean that the KDC will provide the client with a TGT and
> the target realm (where the service is located) in the
> PA-SERVER-REFERRAL of the reply ?
That's sort of the idea, yes. Though Larry Zhu and I were discussing
today what happens if the local KDC has no cross-realm key for the
target realm, but can refer you to an intermediate realm which may
not be able to do referrals; I think the draft is going to need some
work to cover that case.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
