[19436] in Kerberos_V5_Development
Re: [RFE] Add RODC support to MIT Kerberos
daemon@ATHENA.MIT.EDU (Andreas Schneider)
Wed Jun 15 03:29:05 2016
From: Andreas Schneider <asn@samba.org>
To: Greg Hudson <ghudson@mit.edu>
Date: Wed, 15 Jun 2016 09:28:47 +0200
Message-ID: <8791663.zxKgoZS2mx@magrathea.cryptomilk.site>
In-Reply-To: <575EC70E.1030809@mit.edu>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Monday, 13 June 2016 10:45:34 CEST Greg Hudson wrote:
> On 06/13/2016 09:14 AM, Andreas Schneider wrote:
> > * A new KDC error code so we can tell from the KDB the KDC should proxy
> > the
> >
> > request (KRB5KDC_ERR_PROXY_REQUEST).
> >
> > * A new kdb function to get a list of KDCs we can proxy the request to
> > * If the kdb returns KRB5KDC_ERR_PROXY_REQUEST, the KDC should get the
> > list
> >
> > of KDCs we can proxy the packet to from KDB, then start sending the
> > packet
> > to the list we got. Do this until all fail or we get a response from one
> > of
> > the KDCs and send it to the client
> >
> > Please let me know if this makes sense.
>
> This makes sense in the abstract, but I am concerned about the
> complexity of the implementation. We implemented support for
> asynchronous preauth mechanisms in the AS-REQ code path, and I feel like
> it came at a significant cost to the maintainability of do_as_req.c and
> kdc_preauth.c.
I need to look into that. In Samba the packet handling code including the
proxy is ~1000 loc.
> Have you thought about designing a libkdc-like interface for the MIT
> krb5 KDC, so that Samba could do RODC support in the same way as it does
> for Heimdal?
No, not yet. I need to look into that. It would also be nice to have a header
file with all the decode_* and encode_* prototypes.
-- andreas
--
Andreas Schneider GPG-ID: CC014E3D
Samba Team asn@samba.org
www.samba.org
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
