Subject: New draft coming your way

From: "Mike Swift (NT)" <[email-masked]>
Date: Wed, 5 Nov 1997 12:13:38 -0800

I submitted a new draft last night, draft-ietf-cat-iakerb-00.txt, that
specifies a protocol for using Kerberos and the GSS-API for initial
authentication, such as in a dialup situation where there is connectivitiy
available on the client. The general principal is that the client will
create an AS request and rather than send it to the KDC, instead returns it
from GSS_init_sec_context(). The client application sends the AS request to
the service, which then forwards the request to a KDC and fowards the AS
respons from the KDC back to the client. This allows use of Kerberos in
situations where the client can't easily locate a KDC, such as on the
Internet.

- Mike Swift

---

From: Doug Engert <[email-masked]>
Date: Thu, 6 Nov 1997 08:40:36 -0600 (CST)

> situations where the client can't easily locate a KDC, such as on the

Interesting. Sounds like you are addressing the misuse of Kerberos by
many of the firewall/terminal-server vendors. They require you to send
your Kerberos password over the phone line to the concentrator who
then authenticates you via Kerberos.

I have long said that this is backwards, the firewall should really
allow you to send requests to the KDC before you are authenticated.
(and maybe to DNS as well.)  Then you could use normal Kerberos
authentication to authenticate to the firewall/terminal-server which
would then give you full access to other addresses.
 
The "service" in your approach could be the firewall/terminal-server.  

-- 
 
 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444