Proxiable tickets

[Douglas E. Engert]

Another approach is to use the KX509 from the University of Michigan.
It is used to get a X509 certificate from a KCA server using Kerberos 
authentication. The certificate is usually good for one day. 

The certificate and key can be used from IE or Netscape, and the kx509
can run on Windows, UNIX or MAC.  

http://www.citi.umich.edu/projects/kerb_pki/

The nice feature of this is the Web servers are already setup to
use certificates, so these an be used with IIS, or SUNOne for example.

The above certificates can be used for delegation, but their KCT 
package says it can. I have not tried the KCT.)

Frank Taylor wrote:
> 
> All,
> 
> I am building an application that uses Kerberos internally to
> authenticate usage of back end resources. In a move to improve
> internal auditing I'd like to use proxy tickets to handle delegation
> of rights from a user to an intermediary service. Specifically I'd
> like to delegate LDAP access to a web application for a user.
> 
> The plan is that the user's agent will generate a proxiable LDAP
> ticket that it hands to the web application. The web application
> (implmented in J2EE using JSPs and EJBs) will then generate the
> required authenticators to connection to LDAP when required.
> 
> Whilst I believe this is how it should work in theory, I am lost as to
> how to implement this in practice. Specifically, I am not sure exactly
> what should be passed from the client to the web application...
> rfc1510 talks about passing the "proxy", but does not define what this
> is? Is it the TGS REPLY, or is it the underlying ticket?
> 
> Has anyone done anything like this? The Kerberos FAQ says that
> proxiable tickets are not often used.
> 
> Can anyone point me towards information of programming for proxiable
> tickets?
> 
> I am using jKrb5 (the java-kerberos library) to prototype the
> interactions.
> 
> Is there a better solution?
> 
> Thanks,
> 
> Frank Taylor.
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

-- 

 Douglas E. Engert  <DEEngert at anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444