[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Optional domain/realm for SCRAM? (Re: Crypto agility in SCRAM + draft-josefsson-password-auth?)




--On Tuesday, March 18, 2008 01:15:43 PM -0500 Nicolas Williams <Nicolas.Williams@xxxxxxx> wrote:


On Tue, Mar 18, 2008 at 06:21:44PM +0100, Simon Josefsson wrote:
Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:
> Hmmm, I think I can live with this answer, but I also think that a
> SCRAM with this option will have sufficiently different properties from
> Kerberos that in many case it could be preferable (specifically: no
> online infrastructure requirement for the client).

If I understand your scenario, it may be that it can be solved easily
with unmodified SCRAM, see my response to Jeff.

If you mean this:

>> If you really want to achieve something like you want, wouldn't the
>> following work?  Enroll the user once, and then ask the user to use a
>> username like 'user@xxxxxxxxxxxxx', 'user@xxxxxxxxxxxxx' for each of
>> the servers in that realm.  The enrollment process could push out the
>> password-equivalent hash to each server.
>
> Ick.

That is what I do in one (small) environment.  It is simple and works
fairly well.  It is not a load-balancing setup though, where I admit
this approach would not work well.

Then no, that's not a good answer (see Jeff's reply as to why).

The use case is not load balancing (as you asked in your other e-mail
just now) but a large site with many distinct services that users may
need to authenticate to.

Load balancing isn't _the_ use case; it's an extreme example of why it's not reasonable to ask users to use a different username for every server. My users would scream bloody murder if we told them they had to use a different username for every service.

For me though, the point is moot as I withdraw the proposal:

And I don't care enough to press it.

-- Jeff