4 ms·
Kerberos doesn't work through NAT, for one. (I think that there might have been an extension, but it never took off.) Open ID Connect will support the more com
by youdontknowtho 9y ago
Kerberos doesn't work through NAT, for one. (I think that there might have been an extension, but it never took off.)
Open ID Connect will support the more complicated "delegation" scenarios that Kerberos enabled. Think, authentication across multiple service boundaries. That kind of thing.
- gerdesj 9y ago"Kerberos doesn't work through NAT" I can access my email via Evolution EWS through external name -> NAT -> (good TLS) HAProxy (rubbish SSL) -> Exchange 2016 using Kerberos auth.
- sk5t 9y agoYeah, Kerberos can generally work across NAT, but DNS complexity often makes it not worth the trouble.
- youdontknowtho 9y agoGood point. It's naming that often breaks in NAT. And it's naming that is almost always what breaks Kerb. Cheers.
- tjohns 9y agoKerberos absolutely works through NAT. I used it to connect to campus servers back in college, through my home NAT. There is an optional field in the Kerberos ticket that can contain your client address, as an additional point of validation to prevent certain classes of replay attack. That particular feature can conflict with NATs. But it's optional.
- youdontknowtho 9y agoTouche. As one other commenter pointed out, it's naming that can be difficult with NAT and that can break Kerberos. Good point.