[Kerberos] Constrained Delegation Support?

[Marc Boorshtein <mb...@gmail.com>]

Was curious if anyone has looked at constrained delegation support?  I know
its an MS extension and the only APIs that it works with are commercial
libraries so I was curious if anyone had looked at it.

Thanks
Marc

Re: [Kerberos] Constrained Delegation Support?

[Marc Boorshtein <mb...@gmail.com>]

>
>
> I thought KCD did not work across forests/domains but I'm reaching here so
> double check me.  I'm itching to get all over these Kerberos features myself
> but have had no time as usual to get deep into them.  Hopefully we can
> fullfil some of our critical needs on the LDAP side and move on to frolic
> around in the Kerberos side for a while.
>
>
I don't think it does technicly, but it here's the basics of the scenario we
had (I will do a more detailed writeup when I have a few minutes):

Policy dictated that all devices be stored in a different forest then
users.  So there were two forests:
addr.domain.com (with a subdomain of usrs.addr.domain.com) for users and
svc.domain.com with a 2 way cross forest trust between svc.addr.domain.comand
usrs.addr.domain.com.  We were using MS' IAG (intelligent application
gateway) which performed KDC on behalf of the user (authentication to the
IAG was done using Active Directory Federation Services).  The IAG was a
member of the svc.domain.com domain and the users were all in the
usrs.addr.domain.com domain.  We tried a similar scenario using Quest's
SSO/Java and while KDC worked very well for a single forest, kdc for users
in the cross forest trust did not.  The diference appeared to be that the
IAG would:

1.  request a ticket to talk to the user's domain
2.  try to authenticate the ticket to the user's domain

where as SSO/Java (and I never figured out if this was a misconfiguraiton on
my part or an issue with the product) tried to authenticate the ticket
against the svc domain.

Hope that explains it a bit better, if not I can do something more detailed

Marc

Re: [Kerberos] Constrained Delegation Support?

[Alex Karasulu <ak...@gmail.com>]

On Wed, Sep 23, 2009 at 3:01 AM, Marc Boorshtein <mb...@gmail.com>wrote:

> On Tue, Sep 22, 2009 at 7:50 PM, Alex Karasulu <ak...@gmail.com>wrote:
>
>> No we really have not but its not so hard to do I think.  We just need to
>> add the A2D2 attribute to the schema and enable some authorization checks in
>> the KDC to make sure it constrains the service tickets the KDC grants to
>> service accounts based on the contents of this attribute.  Not hard hat all
>> to do I think.
>>
>>
> Well I'll be honest I have no idea how to implement s4u2self and s4u2proxy
> but I will say that IF you guys decide to implement it (which I think would
> be really cool) I can say that what we did run into in our deployment was
> that constrained delegation didn't work well with cross forest trusts where
> a user is in one forest and the device generating and consuming the tickets
> are in a seperate forest.  The commercial product did not work at all.
> Should you guys want to implement I can setup a scenario that would
> reproduce what I saw.
>

I thought KCD did not work across forests/domains but I'm reaching here so
double check me.  I'm itching to get all over these Kerberos features myself
but have had no time as usual to get deep into them.  Hopefully we can
fullfil some of our critical needs on the LDAP side and move on to frolic
around in the Kerberos side for a while.

Cheers,
Alex

-- 
Alex Karasulu
My Blog :: http://www.jroller.com/akarasulu/
Apache Directory Server :: http://directory.apache.org
Apache MINA :: http://mina.apache.org

Re: [Kerberos] Constrained Delegation Support?

[Marc Boorshtein <mb...@gmail.com>]

On Tue, Sep 22, 2009 at 7:50 PM, Alex Karasulu <ak...@gmail.com> wrote:

> No we really have not but its not so hard to do I think.  We just need to
> add the A2D2 attribute to the schema and enable some authorization checks in
> the KDC to make sure it constrains the service tickets the KDC grants to
> service accounts based on the contents of this attribute.  Not hard hat all
> to do I think.
>
>
Well I'll be honest I have no idea how to implement s4u2self and s4u2proxy
but I will say that IF you guys decide to implement it (which I think would
be really cool) I can say that what we did run into in our deployment was
that constrained delegation didn't work well with cross forest trusts where
a user is in one forest and the device generating and consuming the tickets
are in a seperate forest.  The commercial product did not work at all.
Should you guys want to implement I can setup a scenario that would
reproduce what I saw.

Marc

Re: [Kerberos] Constrained Delegation Support?

[Alex Karasulu <ak...@gmail.com>]

No we really have not but its not so hard to do I think.  We just need to
add the A2D2 attribute to the schema and enable some authorization checks in
the KDC to make sure it constrains the service tickets the KDC grants to
service accounts based on the contents of this attribute.  Not hard hat all
to do I think.

Alex

On Wed, Sep 23, 2009 at 1:30 AM, Marc Boorshtein <mb...@gmail.com>wrote:

> Was curious if anyone has looked at constrained delegation support?  I know
> its an MS extension and the only APIs that it works with are commercial
> libraries so I was curious if anyone had looked at it.
>
> Thanks
> Marc
>



-- 
Alex Karasulu
My Blog :: http://www.jroller.com/akarasulu/
Apache Directory Server :: http://directory.apache.org
Apache MINA :: http://mina.apache.org