[27375] in Kerberos
Re: problem obtaining tickets on a webserver
daemon@ATHENA.MIT.EDU (Russ Allbery)
Sun Feb 4 05:16:34 2007
From: Russ Allbery <rra@stanford.edu>
To: dk <dk@kadenpartner.ch>
In-Reply-To: <DFA67206-AC13-4719-8774-E5BC2DCB81A1@kadenpartner.ch>
(dk@kadenpartner.ch's message of "Sun, 4 Feb 2007 09:57:50 +0100")
Date: Sun, 04 Feb 2007 02:11:43 -0800
Message-ID: <87fy9m2pwg.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
dk <dk@kadenpartner.ch> writes:
> If on server 1 the KrbMethodK5Passwd is set to off, the authentication
> on server 1 works too, but server 1 does not save a ticket.
You have to *explicitly* enable ticket delegation in Firefox (and IE, and
hopefully any other browser that does Negotiate-Auth) because handing out
your Kerberos tickets to just anyone is a huge security vulnerability.
See:
<http://www.mozilla.org/projects/netlib/integrated-auth.html>
For Firefox, you have to set network.negotiate-auth.delegation-uris.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
