From: Kyle Schmitt <kyleaschmitt@...>
Date: 2008-06-19T22:21:11+09:00
Subject: Re: How to Authenticate against the Windows NT Domain via Ruby

On Wed, Jun 18, 2008 at 6:38 PM, Clifford Heath <no@spam.please.net> wrote:
> You're quite wrong to bash MS over this. It's true they made
> one small extension to the Kerberos standard and didn't publish
> it until after they got bashed up about it, but the actual
> change they made corrected a deficiency in the Kerberos standard
> itself, by providing a list of group memberships in the TGT
> (Ticket Granting Ticket, the result of the AP, Authentication
> Protocol). The "tokenGroups" attribute gets propagated to the
> service tickets issued in later exchanges,
>
> Without group memberships in the tickets, every service must keep
> a separate access rights (authorization) database with an entry
> for every user, or refer back to the Kerberos server whenever any
> authorization question must be decided. Both alternatives are
> fundamentally at odds with the original design goals of Kerberos
> itself, and is a serious flaw in its design.

Humm, I've never thought about it in that respect before.  But
wouldn't the more appropriate thing be to have group memberships and
service rights stored in the LDAP portion, and only use Kerberos for
the authentication?


--Kyle