https://k5wiki.kerberos.org/w/api.php?action=feedcontributions&feedformat=atom&user=MattCrawfordK5Wiki - User contributions [en]2026-04-22T15:52:40ZUser contributionsMediaWiki 1.27.4https://k5wiki.kerberos.org/wiki?title=Developing_a_preauth_plugin&diff=3868Developing a preauth plugin2011-06-07T19:37:28Z<p>MattCrawford: RFC number wrong: 4210 s/b 4120 /* Recommended Reading */</p>
<hr />
<div>== Recommended Reading ==<br />
* Read RFC 4120<br />
* Read <code>draft-ietf-krb-wg-preauth-framework</code> (version 16 current as of 4/27/2010)<br />
* Read <code>src/include/krb5/preauth_plugin.h</code><br />
* Read <code>src/plugins/preauth/encrypted_challenge/*</code> for a (tragically) comment-less implementation of a preauth plugin implemented using FAST<br />
* ghudson's quick flow overview at http://mailman.mit.edu/pipermail/krbdev/2010-April/008891.html<br />
<br />
== Pre-authentication Limitations ==<br />
* There is no way to require that a certain preauth method is used.<br />
* Likewise, there is also no way to indicate a preferred preauth flow (method A, then B, then C).<br />
* FAST-based preauth (see <code>draft-ietf-krb-wg-preauth-framework</code>) support is largely unimplemented from a practical usage perspective at this point.<br />
<br />
krbdev thread References for above:<br />
* http://mailman.mit.edu/pipermail/krbdev/2010-April/008902.html<br />
* http://mailman.mit.edu/pipermail/krbdev/2010-April/008933.html<br />
<br />
== Notes and Debugging Tips ==<br />
* Define <code>DEBUG</code> as part of your build to tickle logging of more info in your KDC log file (proabably <code>krb5kdc.log</code>).<br />
* Include <code><syslog.h></code>, link against <code>kadm5<something></code> and make liberal use of <code>krb5_klog_syslog</code><br />
* Testing a FAST factor preauth plugin such as <code>encrypted-challenge</code> : http://mailman.mit.edu/pipermail/krbdev/2010-April/008935.html<br />
* Make use of <code>preferred_preauth_types</code> in the <code>[libdefaults]</code> section of <code>krb5.conf</code><br />
* Make use of [http://www.wireshark.org/ Wireshark] (terminal-based command is <code>tshark</code> for those without graphical environments) for examining network traffic.</div>MattCrawford