ldap vs kerberos authentication for idpv3

[Jorj Bauer]

>> With the release of 3.2 it would seem to be the new native mechanism;
>> however, that does not necessarily jibe with the comment you made in your
>> previous email "The latest version has a very poorly tested rewrite that
>> should support service accounts for KDC verification", as "poorly
>> tested"/"should support" and "strongly recommended" typically don't go
>> together ;).
>
> If people don't care and don't use it, then it will remain poorly tested. It isn't recommended by anybody to use Kerberos with no KDC verification.

Don't use JAAS for password authentication via Kerberos.

For those that don't know, JAAS doesn't properly perform kerberos KDC 
validation; it trusts that the KDC's reply of "yep, that password was 
okay" is valid with no cryptographic check to test the validity of that 
reply. That means that with one spoofed UDP packet, you can make an 
application (your IDP in this case) think that AuthN was successful, 
when it really wasn't. Instant authentication bypass (granted, with some 
timing issues).

I just read through Scott's code, and I'm glad to say it's the second 
implementation I've seen (in Java) that does this properly. I was 
starting to feel lonely...

For those that want more context, here's the only public reply I've seen 
from Sun/Oracle on the subject.

Quote from 
http://mail.openjdk.java.net/pipermail/security-dev/2011-March/002948.html 
--

[discussion about krb5_verify_init_creds() being missing] ... In other 
words, if this extra step is not performed inside the Krb5LoginModule 
then it is not secure for validating passwords.  Doing this extra step 
is standard in mod_auth_kerb, pam_krb5, etc.

[reply from Weijun Wang at Oracle]
We've always warned users that simply passing the Krb5LoginModule 
doesn't mean anything and you should always uses this subject in JGSS 
but not regarding itself as some kind of authenticity (say, use it in a 
java policy file).