MIT Kerberos OTP with Windows

[Oleksandr Yermolenko]

thanks for your notes and direction

Oleksandr Yermolenko

On Mon, 30 Oct 2017 20:11:25 -0500
Benjamin Kaduk <kaduk at mit.edu> wrote:

> On Mon, Oct 30, 2017 at 09:05:10AM -0700, Pallissard, Matthew wrote:
> > > any ideas how to implement OTP for Windows with MIT kerberos
> > > client? possible?  
> > 
> > I don't know if KFW 4.1 supports OTP but what I do know is that in
> > the past I couldn't get PKINIT working with KFW. I had to implement
> > heimdal on the client end.
> > 
> > https://www.mail-archive.com/kfwdev@mit.edu/msg00822.html
> > 
> > Could be related.  Someone here could probably speak to that better
> > than myself though.  
> 
> It's quite related, yes.
> 
> The FAST OTP mechanism of RFC 6560 requires a FAST tunnel to exist
> over which the OTP value is sent.  Generally this tunnel is obtained
> via anonymous PKINIT, but PKINIT of all forms is not currently
> implemented in KfW.  In principle, the needed FAST tunnel could be
> obtained in other ways, e.g., via a machine keytab, but the number of
> situations in which these other methods would actually be useful are
> quite limited.
> 
> -Ben
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos