ldap vs kerberos authentication for idpv3

[Cantor, Scott]

On 2/9/16, 7:06 PM, "users on behalf of Charles R. Tompkins" <users-bounces at shibboleth.net on behalf of crt at ufl.edu> wrote:


>
>Additionally, if you pursue the JAAS implementation, watch out for the 
>default "kdc_timeout." In Oracle's Java 8, it is 30 seconds per kdc 
>retry and four retries by default before it fails to the next kdc. You 
>can set it in your krb5 config file to something else, like "kdc_timeout 
>= 1999".

You can set it in java.security also (in fact I thought that was the only place).

>I really like the JAAS kerberos method for IdP v3, just test that kdc
>fail-over!

Clarifying, V3 includes native Kerberos, separate from JAAS. Kerberos and LDAP can both be used via native back-ends or via JAAS.

-- Scott