[28465] in Kerberos
Re: MIT Incremental Propagation
daemon@ATHENA.MIT.EDU (Donn Cave)
Fri Sep 21 20:00:10 2007
From: Donn Cave <donn@u.washington.edu>
Date: Fri, 21 Sep 2007 16:52:11 -0700
Message-ID: <donn-92D6A5.16521121092007@gnus01.u.washington.edu>
X-Complaints-To: help@cac.washington.edu
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
In article <mailman.93.1190407856.2905.kerberos@mit.edu>,
"Kevin Coffman" <kwc@citi.umich.edu> wrote:
> On 9/21/07, Jeffrey Altman <jaltman@secure-endpoints.com> wrote:
> > John Harris wrote:
> > > Greetings,
> > >
> > > Does MIT's current implementation of the Kerberos KDC include
> > > incremental propagation? I know it didn't a long time ago, then there
> > > were CITI patches for it, then those didn't work for awhile. I don't
> > > seem to be able to pinpoint an answer to it.
> > >
> > > Thanks,
> > >
> > > John
> > There is no incremental propagation distributed with MIT Kerberos.
> >
> > Jeffrey Altman
>
> Our patch hasn't been ported forward to release 1.5 and beyond yet.
> With the new plugable database interface, changes are necessary. We
> haven't had the time to get to it yet.
We haven't taken ours to a recent release level yet either, but
for other reasons. It would be interesting, if academic, to see
if our approach would work with 1.6 without changes. I think it
would - it's quite trivial, we just siphon off data (who, what)
from every change kadmind makes, and some other local software
takes it and applies to peer KDCs. One or more of which are
Microsoft domain controllers (but only the MIT KDCs can propagate
changes.) We've been doing this for ca 8 years.
As for an LDAP solution, we've talked about this here before
(cf. "LDAP KDB".) If you need an LDAP backend for some other
reason, that's one thing, but just for replication, I don't
think so.
Donn Cave, donn@u.washington.edu
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
