On Thu, Mar 17, 2011 at 05:43:57PM -0400, Dmitri Pal wrote:
On 03/17/2011 05:36 PM, Linus Nordberg wrote:
> Dmitri Pal <dpal(a)redhat.com> wrote
> Thu, 17 Mar 2011 17:15:46 -0400:
>
> | I updated the site
https://fedorahosted.org/AuthHub/
>
> Just to confirm, this is in line with what we're thinking.
Perfect.
>
> Regarding an asynchronous KDC wrt external servers I guess that you have
> already discussed the possibilities of simply hooking into the existing
> event loop (lib/apputils/net-server.c)? What issues do you see here?
>From what I heard from MIT folks it is not that simple.
We discussed it on multiple occasions and the main concern from MIT is
that turning the 18-year-old KDC into a loop driven architecture might
not be a piece of cake.
Also having an event loop would be only the first step. The internal
preauthentication API needs to be aware of asynchronous
preauthentication methods. My current idea around this is that
asynchronous methods return a flag like PA_ASYNC and are skipped by the
current preauthentication code until all other pa-methods are handled.
If there are no PA_ASYNC methods the results (edata, encrypted keys,
errors) are returned to the client. Otherwise all PA_ASYNC methods are
called (with a new, to be defined async preauthentication API), their
results are collected and then the results are send to the client. This
approach would require only a minimal change to existing code, but as
always, the devil is in the details :-).
bye,
Sumit
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
_______________________________________________
authhub-devel mailing list
authhub-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/authhub-devel