Subject: RE: Proposed Changes to PKINIT

From: "Friedrichs, Paul LCDR" <[email-masked]>
Date: Wed, 28 Feb 2001 08:22:26 -0500

Matt,

Perhaps I have been assuming a capability that doesn't exist in Kerberos.
All the descriptions I've read seem to only address cross-realm
interoperability after the user logs on within his own realm.

Let's say there is an organization that has an office in New York and in
Paris, and there is a Kerberos realm in each location. I have an account in
the New York realm, but I need to log on while visiting the Paris office.
Isn't this supported? If it is, to which of the two ASs/KDCs does the user
initially authenticate?

Thanks,

Paul

---

From: Derek Atkins <[email-masked]>
Date: 28 Feb 2001 09:10:42 -0500

Paul,

Generally, no this is not supported by raw kerberos.  You may be able
to have a login system that has a list of trusted "foreign realms" for
which logins are authorized, but in those cases the user would use
their "own" KDC for initial authentication and then use cross-realm
over to the "local" realm.  So, in your example, you would "login"
using the NYC realm and then cross-realm over the Paris.  However this
requires the login system on the Paris machine to know to look at NYC
for your credentials and trust NYC for login authorization.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 28 Feb 2001 08:48:29 -0600

> Isn't this supported? If it is, to which of the two ASs/KDCs does the user

I know Derek answered no, to this, but I would clarify what's going on here.

It has to do with what do you mean by "log on". There are at least three
functions going on here. (1) authentication, (2) mapping to a local account,
(3) authorization.

(1) Kerberos itself really only does authentication. You could use your NY principal
to authenticate yourself to the machines in the Paris office. It would then
get three tickets krbtgt/NY@NY, krbtgt/Paris@NY, then host/Paris@Paris. 
The last being used bu the local host to verify it is talking to the real KDCs.

(2) You might also have to provide a local userID for the Paris machine. 

(3) The Paris machine would have to deiced if the NY kerberos principal was allowed 
to use the Paris local UserID on this machine (3).

So if you set thing up correctly the answer would be yes. 

One of the problem is that UNIX does not have a concept of a global userID. It only
has local userID. i.e. the realm is not kept with the userID. Where as W2K,
DCE/DFS, AFS (to some extent) do.  

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 28 Feb 2001 15:14:08 -0500

> functions going on here. (1) authentication, (2) mapping to a local account,

[...]

> DCE/DFS, AFS (to some extent) do.  

(2) is needed if the client OS in question has only a flat user
namespace, as does Unix. With a flat user namespace there cannot be a
local vs global vs domain distinction of user accounts. Though even with
a hierarchical user namespace (2) ought to be doable if desired.

Win2k (and winnt) kernels have a hierarchical user id namespace where
user ids consist of a component (SID) identifying a domain or a host
that owns the user (or group) in question and a component (RID),
relative to the first, identifying the user (or group) in question.

Unix could really use that -- some Unices (e.g., BSD 4.4, *BSD,
Solaris) treat process credentials as an opaque object in the kernel
which I imagine could be extended to support hierarchical user ids; one
can only hope.

From an administrator's point of view, flat namespaces are nothing but a
headache.

Nico
--

---

From: Ken Hornstein <[email-masked]>
Date: Wed, 28 Feb 2001 16:49:35 -0500

>Isn't this supported? If it is, to which of the two ASs/KDCs does the user

I know other people have answered this in detail, but I'd just like to
chime in with a small bit of information .... I know of pilot projects
where people have done this (log into one site using a Kerberos password
from another), and I might be working on something similar here.  It's
one of those "policy and implementation dependent" things.  In these
implementations, the user's "home" realm (the foreign one) is used for
initial authentication.

--Ken