WebISO: the killer kerberos app?

[Henry B. Hotz]

There's also kx509.

At 12:00 PM -0500 3/8/04, kerberos-request at mit.edu wrote:
>Date: Mon, 08 Mar 2004 08:38:05 -0500
>From: Wyllys Ingersoll <wyllys.ingersoll at sun.com>
>To: Russ Allbery <rra at stanford.edu>
>Cc: kerberos at MIT.EDU
>Subject: Re: WebISO: the killer kerberos app?
>Message-ID: <1078753084.11770.11.camel at pebblebeach.wki.test.net>
>In-Reply-To: <87brnc9ihf.fsf at windlord.stanford.edu>
>References: <3f5ba094.0403041516.1915ec69 at posting.google.com>
>	 <87brnc9ihf.fsf at windlord.stanford.edu>
>Content-Type: text/plain
>MIME-Version: 1.0
>Content-Transfer-Encoding: 7bit
>Precedence: list
>Reply-To: wyllys.ingersoll at sun.com
>Message: 2
>
>On Thu, 2004-03-04 at 20:43, Russ Allbery wrote:
>>  Christopher Kranz <clk at princeton.edu> writes:
>
>>  > It occurred to me that if you think of the web client as the credentials
>>  > cache Kerberos could easily be used as a WebISO solution.  The web
>>  > client connects to the web app.  If you don't already have a service
>>  > ticket you get redirected to a login server that will prompt you for
>>  > your Kerberos password and get a TGT for you if you do not already have
>>  > one.  So in a sense the web client plus the login server combined looks
>>  > like the traditional Kerberos client.  The login server contacts the KDC
>>  > and gets a TGT and creates a service ticket for the web app.  It ships
>>  > these back to the web client as cookies.  The web client now has
>>  > credentials to give to the web app.  If the client connects to another
>>  > Kerberized web app it is again redirected to the login server but this
>>  > time it can use the stored TGT to obtain a service ticket for the new
>>  > web application.
>>
>>  This is exactly the design of Stanford's WebAuth v3.  :)  See:
>>
>>      <http://webauthv3.stanford.edu/>
>
>
>Isn't this very similar to the what Passport and Project Liberty propose
>to use?  Basically, its a variation of the "secure cookie" scheme.
>Netegrity does something similar as well.
>
>Is there a comparison anywhere between webauthv3 and the WebISO  used
>by the above mentioned projects?  I would be very interested in the
>comparison, just to know who is doing what, exactly, and what the
>benefits are for each system.
>
>One thing I dislike about webauth is that it is using raw KRB5 as
>opposed to the more portable and extensible GSSAPI interface.
>Why was GSSAPI not chosen?  Using raw KRB5 protocol means tying one
>to a particular Kerberos implementation (MIT, Heimdal, Solaris,
>Microsoft).  GSSAPI is a standard interface and is thus more portable
>across platforms and does not restrict a site to only using one
>Kerberos implementation.  It also does not restrict one to using
>Kerberos as the secure authentication protocol.
>
>What about projects that just add support for new authentication methods
>like the "Auth Negotiate" scheme that Microsoft uses?  Work is being
>done by the Mozilla project to support Kerberos auth via GSSAPI in
>a compatible manner:  http://bugzilla.mozilla.org/show_bug.cgi?id=17578
>
>
>--
>Wyllys Ingersoll <wyllys.ingersoll AT sun DOT com>
>
>------------------------------
>
>Date: Mon, 08 Mar 2004 10:40:26 -0500
>From: Sam Hartman <hartmans at MIT.EDU>
>To: wyllys.ingersoll at sun.com
>Cc: kerberos at MIT.EDU
>Cc: Russ Allbery <rra at stanford.edu>
>Subject: Re: WebISO: the killer kerberos app?
>Message-ID: <87eks3uz2t.fsf at luminous.mit.edu>
>In-Reply-To: <1078753084.11770.11.camel at pebblebeach.wki.test.net> (Wyllys
>  Ingersoll's message of "Mon, 08 Mar 2004 08:38:05 -0500")
>References: <3f5ba094.0403041516.1915ec69 at posting.google.com>
>	<87brnc9ihf.fsf at windlord.stanford.edu>
>	<1078753084.11770.11.camel at pebblebeach.wki.test.net>
>Content-Type: text/plain; charset=us-ascii
>MIME-Version: 1.0
>Precedence: list
>Message: 3
>
>>>>>>  "Wyllys" == Wyllys Ingersoll <wyllys.ingersoll at sun.com> writes:
>
>     Wyllys> Isn't this very similar to the what Passport and Project
>     Wyllys> Liberty propose to use?  Basically, its a variation of the
>     Wyllys> "secure cookie" scheme.  Netegrity does something similar
>     Wyllys> as well.
>
>There's also the free software pubcookie.
>
>My personal recommendation for webauth right now seems to be
>supporting both gssapi negotiate and pubcookie.  I'd prefer a stronger
>solution than gssapi negotiate.  The HTTP SASL draft is being last
>called, so perhaps we'll get our wish.


-- 
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu