Moving away from kerberos auth

[Morris, Andi]

Thanks for the answers both. Please see my responses in line.

What do you intend to delpoy instead of Windows Integrated Authentication? Nothing, i.e. forms-based login even from managed PCs?
         - I'm just referring to moving the Shibboleth IdP away from Kerberos authentication. We'd like users on the same domain to have their credentials passed transparently, but users coming in from the internet to hit a login portal.

The only server, I'm guessing, since all your managed PCs are still depending on Kerberos, right?
It doesn't have to the the Shibboleth IDP, it can probably also be a CAS IDP that uses Kerberos. But having one server use Kerberos for things like supporting Windows Integrated Authentication is still useful. I'm sure a mature SAML IDP deployment will be "the only system" with regards to quite a few other aspects as well? That alone doesn't seem like a reason to stop using Kerberos on the server?
        - Yes, I'm just referring to our current reverse proxied services that are authenticated by Kerberos. Currently we cannot get any ADC/load balancer vendor to support authentication against our Windows domain with Kerberos when the server hostname has a different UPN to our internal active directory domain name. Hence the requirement to authenticate Shibboleth users by another means.


Why would you want to run 3 SSO systems when you could only run 1 or 2?  And with CAS' "single sign on possibilities" you're referring to it's proxying and n-tier support, e.g. PAM modules? Have you checked whether the CAS support in the Shibboleth IDP is sufficient to supoprt the CAS clients you intend to deploy?
        - Because at first glance (I'm literally just gathering options at the moment), it appears we need some kind of SSO portal to sit above our published services for users coming into our network from the internet. Not all of our resources are authenticated by ADFS, not all are Shibboleth, and some are neither. I'm aware that you can chain ADFS and Shibboleth together, but this won't help with services that use neither of these methods.

I'm not really understanding why you need a portal. The SPNEGO support in the IdP can co-exist with LDAP or Kerberos authentication via form, and it was designed (by SWITCH) to support things like network-driven use of the SPNEGO option.
        - Thanks, I'm not really up to speed with SPNEGO, but I will investigate the possibilities of authentication via LDAP from a portal form.

AFAIK handling users with Windows Integrated Authentication and ones without -- whether they're on the same network or elsewhere in the world -- should be possibe with the IDP, and should not require an additional reverse proxy handling authentication.
I think Newcastle was one of the first to fully document how that can be done, but there may be more or more up-to-date documentation in the Shibboleth wiki?
        - We don't want to use Windows integrated authentication for outside users. We want them to hit a login portal, enter details, and from that point on be able to access internal services that may be authenticated by ADFS, Shibboleth, or other methods (ldap,ntlm etc)
        - I'll check the Wiki for working examples, thanks for the tip.

Cheers,
Andi

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: 05 July 2016 15:36
To: users at shibboleth.net
Subject: Re: Moving away from kerberos auth

* Morris, Andi <amorris at cardiffmet.ac.uk> [2016-07-05 14:06]:
> We want to upgrade the IdP to version 3, and if possible move it away
> from the Kerberos authentication.

What do you intend to delpoy instead of Windows Integrated Authentication? Nothing, i.e. forms-based login even from managed PCs?

> Shibboleth is currently the only system we run here that is
> authentication with Kerberos

The only server, I'm guessing, since all your managed PCs are still depending on Kerberos, right?
It doesn't have to the the Shibboleth IDP, it can probably also be a CAS IDP that uses Kerberos. But having one server use Kerberos for things like supporting Windows Integrated Authentication is still useful. I'm sure a mature SAML IDP deployment will be "the only system" with regards to quite a few other aspects as well? That alone doesn't seem like a reason to stop using Kerberos on the server?

> (we're keen to use CAS for its single sign on possibilities, and
> because we can run ADFS and Shibboleth alongside each other).

Why would you want to run 3 SSO systems when you could only run 1 or 2?  And with CAS' "single sign on possibilities" you're referring to it's proxying and n-tier support, e.g. PAM modules? Have you checked whether the CAS support in the Shibboleth IDP is sufficient to supoprt the CAS clients you intend to deploy?
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

[Cardiff Metropolitan University - Queens Anniversary Prizes 2015]<http://www.cardiffmet.ac.uk/news/Pages/Cardiff-Met-research-recognised-in-Queens-Anniversary-Prizes-for-Higher-and-Further-Education.aspx>