ldap vs kerberos authentication for idpv3

[Cantor, Scott]

> Granted; on the other hand, I don't necessarily want to deploy alpha quality
> code in production :).

If the KDC check fails, it won't let you login, but that won't suddenly stop working in production. Rod tried to make it work with AD and couldn't, and I had no quick way to try it and lots of more important things to get done for the release, so I just tested MIT and left it there.

> Just to clarify, there are no known issues with the
> implementation, it is expected to work, it simply hasn't been deployed at
> scale yet?

I'm not aware of any, but the new native flow essentially reuses the JAAS module to do TGT acquisition as of 3.2, so in effect they're one and the same if you skip the KDC check now. The JAAS module is certainly used at scale now.

-- Scott