heimdal http proxy

[Charles Hedrick]

Another use case is getting tickets for Mac users. We have a few users that ssh into enough different hosts that they want to use kerberized ssh. Unless we open port 88 to the outside, they have to install Mac ports and use the MIT kinit. While it seems simple to me, it’s not for real users. If they could point Heimdal to a proxy I think it would be easier to support. It won’t work for two factor, since Apples Heimdal kinit doesn’t support that, but most of users don’t use two factors, just privileged users.

The easier solution would be for Apple to move to MIT, but I have no way to make that happen.

> On Sep 11, 2021, at 2:22 PM, Rick van Rein <rick at openfortress.nl> wrote:
> 
> Hello Charles,
> 
>> I???d like to be able to use Kerberos SPNEGO at home. Unfortunately the Mac uses Heimdal. 
> 
> SPNEGO has really a low security level.  I am surprised this is considered
> acceptable for a https proxy.
> 
> We are working on two better solutions, with software that classifies only
> little over "proof of concept'.
> 
> - TLS-KDH to integrate Kerberos authentication with ECDH encryption;
>   this combination is in fact Quantum Proof
> 
>   https://datatracker.ietf.org/doc/html/draft-vanrein-tls-kdh
> 
> - HTTP-SASL integrates SASL as a HTTP authentication mechanism, and this
>   is meant to allow Kerberos as well.  In contrast with SPNEGO, it would
>   be possible to require Channel Binding (at least to the webserver _name_).
> 
>   https://datatracker.ietf.org/doc/html/draft-vanrein-httpauth-sasl
> 
> 
> Take note: These have not even been proposed on this list, simply due to
> lack of time to actively discuss it (been mostly occupied with this and
> related implementations).  So at best this could be a future opportunity.
> Still, your usecase may help to propell the work forward, so please share
> if this would be helpful for your situation.  You may want to pass this
> by your sysadmin too.
> 
> 
> Cheers,
> -Rick