Re: Authenticating on kerberos via certifates



Andrea wrote:
Hi all,
I'm facing with this problem:

I have a working authentication configure system that uses Kerberos
for authentication. The credentials that have to be passed in order to
obtain a TGT are username and password. Now I'm looking for some hint
on how to authenticate on kerberos through certificates like X.509.

This is what I want:

Let's assume that an user has a valid certificate created by a CA. The
user can authenticate himself without prompting any user/pwd but just
having the certificate. According to you is it possible to construct
an intermediate layer between the user and kerberos which maps the
certificates in credentials allowing Kerberos to authenticate the user
himself.

Yes, that is called PKINIT, Heimdal and MIT have just introduced this
late last year. Windows has also supported this since W2000, as smart
card login. All three have clients and KDCs, and can intreroperate.

On Unix for login at the console you will also need a pam_krb5 like
http://www.eyrie.org/~eagle/software/pam-krb5/

Usually the certificate and private key are on a smartcard. So also see
http://www.opensc-project.org/


Thanks in advance,
Andrea
________________________________________________
Kerberos mailing list Kerberos@xxxxxxx
https://mailman.mit.edu/mailman/listinfo/kerberos



--

Douglas E. Engert <DEEngert@xxxxxxx>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
.

Relevant Pages

  • Re: ADAM - ldp bind credentials change when using machine account
    ... Kerberos errors are actually related for some reason. ... System account to run the ADAM instance or a fixed service account? ... you can see that the machine credentials are authenticated ...
    (microsoft.public.windows.server.active_directory)
  • Re: VPN Access
    ... Make sure that you are logging onto your computer with credentials that will ... authenticate you to your domain resources. ... User Certificate is Valid ... successfully and I can access share drive on one server. ...
    (microsoft.public.windowsxp.security_admin)
  • Authenticating on kerberos via certifates
    ... I have a working authentication configure system that uses Kerberos ... The credentials that have to be passed in order to ... on how to authenticate on kerberos through certificates like X.509. ...
    (comp.protocols.kerberos)
  • How to find out why credentials have expired
    ... I am using Kerberos 5 to authenticate an AD user from Linux RHEL 5.1 ... can I find out why and how his credentials have expired. ...
    (comp.protocols.kerberos)
  • kerberos and web-single signon, a good solution??
    ... I am not at 100% familiar with Kerberos, so I dont know if my idea ... I wanted to authenticate the user on the first connection using their ... Based on the certificate, it should be possible to get ... Is this scenario possible and if yes, will it be transparent to the ...
    (comp.security.unix)