jaas+krb5 vs krb5 backed password authentication

[Liam Hoekenga]

Is the JAAS configuration that actually authenticated the user available to
shibboleth somehow outside of the authentication event itself?  Maybe in
the subject?

On Tue, Mar 26, 2019 at 7:13 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/26/19, 7:08 PM, "users on behalf of Liam Hoekenga" <
> users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:
>
> > Here's our jaas.config...
>
> You're telling it to authenticate itself as a service principal, so that's
> what it does. It's not doing anything with the user's credentials at all.
>
> Sun's Kerberos module has no support for KDC verification. Giving it a
> keytab doesn't make that happen, it just bypasses the user login and turns
> into a service login. The IdP should probably be a bit more safe there and
> verify the principal coming back. I thought it did, but I would have to
> look at it. That's a reasonable enhancement, maybe just with some kind of
> pluggable comparison function, but there's no inherent contract in JAAS
> that lets the IdP verify the results of a module, all it really knows is
> the login() method didn't fail.
>
> -- Scott
>
>
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190327/83d6ff72/attachment.html>