ldap vs kerberos authentication for idpv3

[Youssef GHORBAL]

>> In any case, we also have a heavily used kerberos deployment on campus that is the authentication back end for our unix systems and our secure nfs deployment. Particularly given I see that SPNEGO is supported in idpv3 I'm seriously considering switching to kerberos for idpv3 and just using ldap for attributes, not authentication.
> 
> I certainly advocate it, it's much simpler, faster, more reliable, etc. What people don't like about it is that they think it's a "feature" to let people enter ten different kinds of data and login with any of them.
> 
> The latest version has a very poorly tested rewrite that should support service accounts for KDC verification, which looks a lot like SPNEGO and probably should be sharing code with it, but I did all that before I had SPNEGO in front of me.
> 
>> But before I did, I thought I'd just see how many people were, and how well it was working for them, and if there were any caveats or concerns I should take into consideration before moving forward with it.
> 
> I've used it with V2 with just the old JAAS module for ten years. Primarily with MIT, now switching to an AD. Not thrilled with the move to TCP, but it's been fine so far, just been a few days though.
> 
> Anyway, I maintain it should be the go-to choice for the majority of sites, given that the majority now have AD anyway.

I don’t seem to get it here, I clearly see the advantage of Kerberos authentication provided by the authn/Password, but not the SPNEGO one.
You can correct me if I’m wrong, but in the SPNEGO flow, at some point, the client (the browser or the OS running the browser) needs to talk to the KDC. And thus making restrictions on the location and the control you have over the said client (time sync, network access to the KDC, etc) If you don’t have tight control over the client, it’s clearly an obstacle. I think about use cases when the client is outside the network bouderies (and in other timezones) and needs to access simple web ressources on less trusted clients (cybercafe, family computer, etc)
Another aspect is concerning the SPNEGO support on mobile devices (iPads, iPhones, Androids etc) i cant’ find any clear status on the support level.

Maybe you should concider activating both flows, Password alongside SPNEGO (and you end up with supporting LDAP authentification anyway)

Youssef