https://k5wiki.test.kerberos.org/wiki?action=history&feed=atom&title=Release_Meeting_Minutes%2F2012-06-05 2026-05-14T16:49:38Z Revision history for this page on the wiki MediaWiki 1.27.4 https://k5wiki.test.kerberos.org/wiki?title=Release_Meeting_Minutes/2012-06-05&diff=4681&oldid=prev 2012-06-06T21:52:33Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 21:52, 6 June 2012</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>{{minutes|2012}}</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Steve Buckley, Thomas Hardjono, Sam Hartman, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>Steve Buckley, Thomas Hardjono, Sam Hartman, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> </table>

TomYu https://k5wiki.test.kerberos.org/wiki?title=Release_Meeting_Minutes/2012-06-05&diff=4680&oldid=prev 2012-06-06T21:35:40Z

<p>New page: Steve Buckley, Thomas Hardjono, Sam Hartman, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu == Keytab based initiator creds == ;Greg: Keytab based initiator creds. :# when? :# princ? :#...</p> <p><b>New page</b></p><div>Steve Buckley, Thomas Hardjono, Sam Hartman, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu<br /> <br /> == Keytab based initiator creds ==<br /> <br /> ;Greg: Keytab based initiator creds.<br /> :# when?<br /> :# princ?<br /> :# where to cache?<br /> ;Greg: App might provide a desired principal name.<br /> <br /> ;Sam: Not sure about using default ccache. If application A requests a principal, can unexpectedly change the behavior of application B which uses default creds but normally doesn't see any.<br /> <br /> ;Simo: Thought keytab<br /> <br /> ;Sam: Application can pass in a specific name.<br /> <br /> ;Simo: If you want app to use a specific name, app should set ccname. Just doing automatic init without administrator configuration is undesirable.<br /> <br /> ;Sam: Do if you have hint from either environment or app.<br /> <br /> ;Thomas: Precedence?<br /> <br /> ;Greg: Usually application, then environment variables, then config. If application provides a name is it a sufficient hint?<br /> <br /> ;Sam: Application could start using Kerberos when not intended. Once you've got cache collection... makes sense to pass a name to init_sec_context. If you have something in .k5identity, then always do keytab initiator creds. Think about keytabs using MSLSA analogy... keytabs extended by ccaches.<br /> <br /> ;Simo: Don't like blocking operations during enumeration.<br /> <br /> ;Greg: Special cache.... interacts with some APIs, may not get destroyed when default cache does, etc.<br /> <br /> ;Sam: If collection, then use it; otherwise memory.<br /> <br /> ;Simo: Seeing as daemons would be OK with environment variables... have .k5identity later.<br /> <br /> ;Sam: But there is a reasonable way to get portable...<br /> <br /> ;Simo: Not easy to find example code. Don't want people to use gethostbyname.<br /> <br /> ;Tom: Do they do that for initiators? More common to use gethostbyname for acceptor.<br /> <br /> == Import/export creds ==<br /> <br /> ;Greg: GSS proxy... so every existing app...<br /> <br /> ;Simo: Mostly for acceptors<br /> <br /> ;Greg: But if S4U2Proxy, the app can also be an initiator. Acceptor cred. init. delegated cred. memory ccache.<br /> <br /> ;Sam: Not sure marshalling makes sense. Have tried to make portable. Can move across privilege boundary, etc.<br /> <br /> ;Greg: Context vs name. Can't do with KDB keytab. (but you probably don't want to do that)<br /> <br /> ;Sam: When deferring credential resolution.<br /> <br /> ;Greg: Default cred. Don't want people to depend on...<br /> <br /> Sam wants it to be portable between versions. Some discussion. It could be hard. Is the lucid context good enough for most uses?</div>

TomYu