[19402] in Kerberos_V5_Development
Re: Implementing a KDB plugin
daemon@ATHENA.MIT.EDU (Greg Hudson)
Thu May 5 18:03:40 2016
To: harsh savla <harsh.savla@gmail.com>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <572BC330.7090604@mit.edu>
Date: Thu, 5 May 2016 18:03:28 -0400
MIME-Version: 1.0
In-Reply-To: <CACbP_Ka0SwbN_H09FUMSGgJOWG6=WOcu-j47T49f_jxRQkQaJQ@mail.gmail.com>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 05/05/2016 05:25 PM, harsh savla wrote:
> I was thinking along the lines that the security blob (encrypted using
> the user's password as a key) received by the krb5kdc service on user
> login will be passed to the cloud service via the kdb plugin.
It may be possible to gateway from the Kerberos protocol to a web
service and back to the Kerberos protocol again, but the MIT krb5 KDC
cannot be transformed into such a gateway element by a KDB module. KDB
modules can control how principal metadata and key data is retrieved,
and can participate in some policy decisions, but they cannot make
radical alterations to the basic protocol flow.
We do implement an HTTP proxy protocol called MS-KKDCP in our clients as
of release 1.13, but it's a bit different than what you describe.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
