[19435] in Kerberos_V5_Development
Re: [RFE] Add RODC support to MIT Kerberos
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jun 13 10:45:50 2016
To: Andreas Schneider <asn@samba.org>, krbdev@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <575EC70E.1030809@mit.edu>
Date: Mon, 13 Jun 2016 10:45:34 -0400
MIME-Version: 1.0
In-Reply-To: <2390437.NNsJer83B1@magrathea.cryptomilk.site>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 06/13/2016 09:14 AM, Andreas Schneider wrote:
> * A new KDC error code so we can tell from the KDB the KDC should proxy the
> request (KRB5KDC_ERR_PROXY_REQUEST).
> * A new kdb function to get a list of KDCs we can proxy the request to
> * If the kdb returns KRB5KDC_ERR_PROXY_REQUEST, the KDC should get the list
> of KDCs we can proxy the packet to from KDB, then start sending the packet
> to the list we got. Do this until all fail or we get a response from one of
> the KDCs and send it to the client
>
> Please let me know if this makes sense.
This makes sense in the abstract, but I am concerned about the
complexity of the implementation. We implemented support for
asynchronous preauth mechanisms in the AS-REQ code path, and I feel like
it came at a significant cost to the maintainability of do_as_req.c and
kdc_preauth.c.
Have you thought about designing a libkdc-like interface for the MIT
krb5 KDC, so that Samba could do RODC support in the same way as it does
for Heimdal?
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
