Subject: RE: [Isms] Re: securityName/groupName

From: "Nelson, David" <[email-masked]>
Date: Wed, 24 Aug 2005 15:57:26 -0400

Sam Hartman writes...

> Yes, but I think a lot of operators who do use things like Kerberos
> may also use RADIUS for authorization.

Do you have any specific examples in mind?  I'm not aware of any hybrid
Kerberos/RADIUS applications where Kerberos provides authentication and
RADIUS provides [unauthenticated] authorization.

Or did you mean something else?

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Sam Hartman <[email-masked]>
Date: Wed, 24 Aug 2005 16:04:09 -0400

>>>>> "Nelson," == Nelson, David <[email-masked]> writes:

    Nelson,> Sam Hartman writes...
    >> Yes, but I think a lot of operators who do use things like
    >> Kerberos may also use RADIUS for authorization.

    Nelson,> Do you have any specific examples in mind?  I'm not aware
    Nelson,> of any hybrid Kerberos/RADIUS applications where Kerberos
    Nelson,> provides authentication and RADIUS provides
    Nelson,> [unauthenticated] authorization.

I'm aware of cases where RADIUS servers will take passwords and then
use Kerberos for authentication.

I would consider it unacceptable to force ssh implementations in such
a case to use password rather than gssapi-with-mic.