Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

[Nico Williams <[e-mail]>]

On Tue, Feb 21, 2023 at 03:29:45PM -0500, Simo Sorce wrote:
> On Tue, 2023-02-21 at 11:31 -0600, Nico Williams wrote:
> > On Tue, Feb 21, 2023 at 04:44:15PM +0000, Steve Syfuhs (AP) wrote:
> > > You might also consider Active Directory's (group) managed service
> > > accounts. At least the group keying mechanism.
> > 
> > Where would I learn more about that?
> 
> FreeIPA has a similar feature geared towards unix systems where
> traditionally different services use different keytabs.
> It allows to delegate a specific service (say the host principal) the
> ability to fetch keytabs for other services (not necessarily in the
> same name either).
> 
> Old design page here, may look somewhat different these days:
> https://www.freeipa.org/page/V4/Keytab_Retrieval_Management

Right, this is the sort of thing we need.

I'll note that with the HTTP approach we took in Heimdal the client can
be curl(1) or any Python requests or .. any HTTP client you like that
can do Negotiate or JWT.

It doesn't get easier for interoperability than that.  We even get to
negotiate Content-Type if need be (so we could return passwords a la AD
if that were necessary, or keytabs, or whatever format is needed for
whatever software stacks people have).

Nico
--