Subject: Re: Rechartering

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 7 Dec 2006 15:40:31 -0800

Second.

Another approach might be based on the ok-as-delgate flag, but it  
ought to be kdc-enforced.

On Nov 6, 2006, at 8:46 AM, Douglas E. Engert wrote:

> I believe there is a need to allow the user to have better control and
> auditing over the delegation of credentials. The current method of
> forwarding a full TGT can lead to compromises in a diverse cross realm
> environment.
>
> The failure to have this control limits the usefulness of Kerberos
> in such environments, and discourages the deployment of Kerberos  
> across
> organizations.
>
> It is not clear the best way to go about this. It could include  
> policies
> in the KDC to limit the max times a TGT could be forwarded. For  
> auditing
> it could include adding a reference to which host was involved in the
> delegation.
>
> One interesting approach might even be to having a user in run  
> their own
> realm! So all requests for forwarded tickets are routed back to the
> user's personal realm where the KDC can notify the user. There are  
> many
> issues with this, and it is not well thought out, but it gives the end
> user (or his KDC) control over the delegation process.
>
> -- 
>
>  Douglas E. Engert  <[email-masked]>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439
>  (630) 252-5444

------------------------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]