[SSSD] GSSAPI and Kerberos - understanding question
John Hodrien
J.H.Hodrien at leeds.ac.uk
Mon Nov 28 17:01:36 UTC 2011
On Mon, 28 Nov 2011, Ondrej Valousek wrote:
> I do not think so - see my post earlier today. I think it actually makes a
> sense in terms of improved security. You can tell your KDC which TGS tickets
> can be issued for a specified machine.
> I good article is here:
> http://technet.microsoft.com/en-us/library/cc755804%28WS.10%29.aspx
It wasn't clear to me what security benefit you're describing here. What
*specifically* do you think this improves security wise?
I wasn't clear how you could use this to tell your KDC which TGS tickets can
be issued for a specified machine, given the specified machine's kerberos
credential is allowed to create new service principals.
jh
More information about the sssd-devel
mailing list