5 ms·
Looks like you're using Kerberos in a corporate setting? Purely out of curiosity, what does that look like? Is the entire company's authentication infrastructur
by arjvik 4y ago
Looks like you're using Kerberos in a corporate setting? Purely out of curiosity, what does that look like? Is the entire company's authentication infrastructure based on Kerberos? Is it used only for access to development infrastructure? Do you make use of the more "advanced" features of Kerberos like forwarding tickets for something like deployment/CI?
Until now, I genuinely thought Kerberos was used mostly only by MIT.
- AndrewDucker 4y agoWindows has used Kerberos as its authentication mechanism since Windows 2000.
- yrro 4y agoActive Directory uses Kerberos for authentication, it's safe to say it's pretty widely used outside of MIT. :) Our user accounts live in an AD DS. We use FreeIPA (actually Red Hat Identity Management) to manage a second domain for Linux stuff. There is a trust between the domains so that users can log into systems with their AD credentials. It all works pretty well; most of my frustrations with the system are because of AD's limitations (chiefly, lack of built-in MFA; awful documentation; lack of decent tooling for creating keytabs & configuring resource-based constrained delegation, seriously, I can't believe how bad the AD admin tools are) and flaws in how we have configured AD (obsolete protocols and ciphers still in use; the trust is one-way so users on Windows machines can't authenticate to services in the FreeIPA domain). This is for logging on to end user devices & accessing servers. Web apps we don't configure (any more) to use LDAP for authentication, rather OpenID Connect (against Azure AD, the confusingly similarly named service from MS, that syncs user accounts from AD DS). Where web apps want access to Kerberos-protected resources, we have some... interesting... setups to allow web apps to use constrained delegation to impersonate the users who have logged in (and this is another thing about AD DS that surprises me... it's incredibly easy to create a service principal that can impersonate any user when authenticating to a resource, including highly privileged users... there's nothing anywhere near as flexible as FreeIPA's Service Constrained Delegation mechanism, that can say "this service can impersonate anyone in group A to resource B") CI/CD is a bit too advanced of a concept for our AD audience :), we just keep an eye on the platforms and products that our users use & make sure they're doing the right thing with respect to token handling, etc.
- arjvik 4y agoThanks, this is wonderfully in-depth!