[27677] in Kerberos
Re: GSS-API routine for renewing credentials
daemon@ATHENA.MIT.EDU (Robert)
Wed Apr 18 17:50:42 2007
Message-ID: <000401c78202$43a37600$8ff5fea9@rapido>
From: "Robert" <rob_krb@xs4all.nl>
To: "Nicolas Williams" <Nicolas.Williams@sun.com>
Date: Wed, 18 Apr 2007 23:41:03 +0200
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
----- Original Message -----
From: "Nicolas Williams" <Nicolas.Williams@sun.com>
To: "Robert" <rob_krb@xs4all.nl>
Cc: <kerberos@mit.edu>
Sent: Wednesday, April 18, 2007 22:23
Subject: Re: GSS-API routine for renewing credentials
> On Wed, Apr 18, 2007 at 08:25:39PM +0200, Robert wrote:
>> Does anyone know whether there is a routine in GSS-API to renew
>> (forwarded)
>> client credentials? I'm unable to locate such a routine in GSS-API, but
>> maybe
>> I'm overlooking it.
>
> There's no such thing.
>
> In SSHv2 we deal with this by re-keying the SSHv2 session and, in the
> process, establishing a new GSS-API security context, which is an
> opportunity to delegate a new credential.
>
> I.e., you have to establish a new security context.
>
> Nico
> --
Thanks Nico.
I'm just thinking how that would work (if that would work for my situation).
I looking at this from a client -> gateway -> backend server perspective.
The client should actually not be bothered by the need to initiate a new
security context with the gateway. That's what you indicate, right?
(The gateway may need the delegated credentials to initiate a new security
context to a second backend server (silentl failover)).
Robert
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
