Subject: RE: [Isms] Re: securityName/groupName

From: "Nelson, David" <[email-masked]>
Date: Wed, 24 Aug 2005 16:33:05 -0400

> I'm aware of cases where RADIUS servers will take passwords and then
> use Kerberos for authentication.

Absolutely.  RADIUS servers generally use "call outs" to other
authentication systems, including Kerberos, NIS, Active Directory, etc.

> I would consider it unacceptable to force ssh implementations in such
> a case to use password rather than gssapi-with-mic.

This may place a requirement of the AAA infrastructure (RADIUS,
Diameter, etc.) to support gssapi-with-mic as an authentication method
within the respective protocols.

Today, RADIUS supports password (PAP), CHAP, MS-CHAP, and EAP.  There is
a draft in RADEXT to add Digest Authentication [RFC2617] for SIP usage.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Aug 2005 16:48:11 -0400

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    Nelson,> This may place a requirement of the AAA infrastructure
    Nelson,> (RADIUS, Diameter, etc.) to support gssapi-with-mic as an
    Nelson,> authentication method within the respective protocols.
"you could do it that way."

Honestly I think that separating authorization and authentication in
this instance is a better architectural approach.  It is the approach
adopted by PAM and a fair number of network applications that use
plugins for passwords+authorization but just handle authorization when
network authentication is taking place.