Groups | Search | Server Info | Login | Register

Groups > comp.protocols.kerberos > #5406

Re: IAKERB Starter Credentials Solution

Show all headers | View raw

On Sat, Apr 26, 2025 at 07:32:35PM -0400, Michael B Allen wrote:
> Ideally there should be some unix socket service that just processes gss
> tokens.

That's gssd, variously named.

> Being a separate process it can do crypto without exposing base keys and
> even store the plaintext password (encrypted of course) used to login to
> the device and achieve true SSO.
> It would provide persistence so that transient processes can get creds
> without prompting.
> It would normalize the prompting.

If you want apps not to see even passwords, then you can only do this by
having a visual desktop and dialog pop-ups _or_ (and/or) the OS can
use the login and screen unlock interactions + caching.

> Presumably no such service exists so what can I do?

No, it does.  It's called gssd, or rpc.gssd, etc.

> You seem to be suggesting that each of potentially multiple applications
> should be able to trap on an error, prompt for initial credentials (in
> whatever way) and then do an a-typical gss_acquire_cred_with_password with
> just the IAKERB mech.

No, I'm suggesting that only the login screen, screen unlock screen, and
RDP-like apps should bother with interaction for initial credential
acquisition.

Nico
-- 

Back to comp.protocols.kerberos | Previous | Next | Find similar

Thread

Re: IAKERB Starter Credentials Solution Nico Williams <nico@cryptonector.com> - 2025-04-26 19:46 -0500

csiph-web