4 ms·
Kerberos is a) relatively complex to set up properly if its not a Windows in AD b) an SSO, not federated ID. Which means reasking MFA is not possible.
by adontz 3y ago
Kerberos is
a) relatively complex to set up properly if its not a Windows in AD
b) an SSO, not federated ID. Which means reasking MFA is not possible.
- josephcsible 3y ago> reasking MFA is not possible Isn't reasking MFA on purpose just a way to make people hate MFA? Shouldn't everything support a "Trust this device" option and then never ask again from it?
- adontz 3y agoI'd rather reask credentials before elevating effective access level. Just like sudo reasks password. I don't mean reasking MFA to access corporate intranet website with a blog no one reads, I mean reasking for administrative access.
- mmh0000 3y agoCheck out FreeIPA (or Red Hat IdM if you like paying for things.). It’s Kerberos and a few other utilities in a very easy to setup package. It also support OTP MFA https://www.freeipa.org/ https://www.freeipa.org/ https://www.freeipa.org/page/V4/OTP https://www.freeipa.org/page/V4/OTP
- gnufx 3y agoMIT Kerberos supports preauth with OTP, or PKINIT (X.509 certifies); I don't know what Heimdal currently has. FreeIPA has been doing good work past that, on integrating FIDO, for instance, and can issue tickets on the basis of external identity providers. It certainly does more -- like a souped-up AD.
- gnufx 3y agoI don't see how setting up MIT or Heimdal Kerberos is complex compared with AD (which is more than Kerberos); they seem easy enough to me. SSO seems to me what you want, and Kerberos is the reasonable implementation.