ldap vs kerberos authentication for idpv3

[Charles R. Tompkins]

On 02/08/2016 03:01 PM, Paul B. Henson wrote:
> We are finally getting around to working on upgrading to idp v3 (too much to do, too few resources, I'm sure many educational institutions can sympathize <sigh>), and I was curious how many sites authenticate via ldap compared to how many authenticate via kerberos?
>
> When we originally deployed idpv2, we went with ldap authentication, as all of our attributes were in our openldap directory and it seemed the simplest thing to do. I've never really like using ldap for authentication, while it is a great source of authorization, it has always seemed a stretch to consider it an authorization source. It has a number of characteristics that make it annoying as an authorization source, such as its lack of case sensitivity, it will happily authenticate a mixed case UsERNAme, as well as one with leading or trailing white space, which really confuses an underlying application. We worked around that in idpv2 with client-side JavaScript on the login page, I'm not sure if there was a better way in v2 or is a better way in v3. In any case, we also have a heavily used kerberos deployment on campus that is the authentication back end for our unix systems and our secure nfs deployment. Particularly given I see that SPNEGO is supported in idpv3 I'm seriou!
>   sly consi
>   dering switching to kerberos for idpv3 and just using ldap for attributes, not authentication.
>
> But before I did, I thought I'd just see how many people were, and how well it was working for them, and if there were any caveats or concerns I should take into consideration before moving forward with it.
>
> Thanks much...
>
> --
> Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
> Operating Systems and Network Analyst  |  henson at cpp.edu
> California State Polytechnic University  |  Pomona CA 91768
>
>

We are using kerberos via JAAS in IdP 2.4 and 3.2.1.  Like you, we have 
a significant krb deployment.

The only "concern" that I have is that this method depends on your 
Java's kerberos implementation. We were bit once back in the Java 6 
days, but I don't recall the exact issue.

Additionally, if you pursue the JAAS implementation, watch out for the 
default "kdc_timeout." In Oracle's Java 8, it is 30 seconds per kdc 
retry and four retries by default before it fails to the next kdc. You 
can set it in your krb5 config file to something else, like "kdc_timeout 
= 1999".

Incidentally, the modern MIT krb5 client ignores the "kdc_timeout" 
directive in it's config file as it uses a different, faster method to 
fail to next.

I really like the JAAS kerberos method for IdP v3, just test that kdc 
fail-over!

Regards,

Charles Tompkins
University of Florida Information Technology



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3691 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160209/27f89039/attachment.p7s>