ldap vs kerberos authentication for idpv3

[Cantor, Scott]

> With the release of 3.2 it would seem to be the new native mechanism;
> however, that does not necessarily jibe with the comment you made in your
> previous email "The latest version has a very poorly tested rewrite that
> should support service accounts for KDC verification", as "poorly
> tested"/"should support" and "strongly recommended" typically don't go
> together ;).

If people don't care and don't use it, then it will remain poorly tested. It isn't recommended by anybody to use Kerberos with no KDC verification.

> Which one are you using in production :)?

I'm still on V2, and I don't have the ability to get a service account in the AD we'll be using for Kerberos going forward, so I don't expect to be able to take advantage of that feature unless that changes.

-- Scott