4 ms·
Well, yeah, since Kerberos stubbornly hasn't re-invented itself to use HTTP over port 80. Another option you could have said was client-side SSL certificates,
by lstamour 13y ago
Well, yeah, since Kerberos stubbornly hasn't re-invented itself to use HTTP over port 80.
Another option you could have said was client-side SSL certificates, though they're simply not portable enough for most uses.
Finally, why bother implementing a sign-in service at all? You could follow the AccountChooser model and simply allow users to sign in using their own existing email address. Details at the recently redesigned http://www.accountchooser.net/developers http://www.accountchooser.net/developers ... though to support email providers you don't already have IdP relationships for, I guess that means letting them sign up for a password via email validation after all.
Well, if nothing else, I think it points out that Kerberos was designed for one institution, but today we often want multiple identities on the web, and that better fits a decentralized, browser-stored model of "SSO" or login, e.g. AccountChooser screens.