Creating a new pre-authentication plugin

[Greg Hudson]

On 08/01/2012 04:06 AM, Alejandro Perez Mendez wrote:
> Is there any coding
> guidelines available for pre-authentication plugin developers, or for 
> MIT Kerberos developers in general (i.e. how to format the code, how to 
> comment the code...)?

Please see:

http://k5wiki.kerberos.org/wiki/Contributing_code
http://k5wiki.kerberos.org/wiki/Coding_style

For a project like this, I would strongly suggest beginning with a
project proposal, so you can get design review before you put a lot of
effort into code.  To do that, you'll need to get a wiki account, which
for spam-related reasons isn't automatic.  Send your preferred account
name to tlyu at mit.edu and he should be able to set that up.

Some issues I would expect to see for this project include:

* I don't believe our current preauth plugin framework supports multiple
hops; it would need to be extended.

* KDC statelessness is a serious concern for us, just as it was within
the IETF working group.  The draft argues that the KDC should not be
considered "stateful" because the state lies within the GSSAPI objects,
but that position does not resolve the practical issues which give rise
to the statelessness requirement.

* How can we test this with good code coverage as part of "make check"?

* How do we prevent loops where the client attempts to use gss-krb5 to
satisfy the preauth mechanism and that devolves into another AS request?