jaas+krb5 vs krb5 backed password authentication

[Cantor, Scott]

On 3/26/19, 7:08 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> Here's our jaas.config...

You're telling it to authenticate itself as a service principal, so that's what it does. It's not doing anything with the user's credentials at all.

Sun's Kerberos module has no support for KDC verification. Giving it a keytab doesn't make that happen, it just bypasses the user login and turns into a service login. The IdP should probably be a bit more safe there and verify the principal coming back. I thought it did, but I would have to look at it. That's a reasonable enhancement, maybe just with some kind of pluggable comparison function, but there's no inherent contract in JAAS that lets the IdP verify the results of a module, all it really knows is the login() method didn't fail.

-- Scott