https://k5wiki.kerberos.org/wiki?action=history&feed=atom&title=Release_Meeting_Minutes%2F2011-08-23 2026-04-14T16:39:19Z Revision history for this page on the wiki MediaWiki 1.27.4 https://k5wiki.kerberos.org/wiki?title=Release_Meeting_Minutes/2011-08-23&diff=3927&oldid=prev 2011-08-23T19:34:13Z

<p>New page: {{minutes|2011}} Will Fiveash, Carlos Garay, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkova, Tom Yu ==Proxy GSS== ;Carlos: Proxy GSS in Java for Android. Privilege separation ha...</p> <p><b>New page</b></p><div>{{minutes|2011}}<br /> Will Fiveash, Carlos Garay, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkova, Tom Yu<br /> ==Proxy GSS==<br /> ;Carlos: Proxy GSS in Java for Android. Privilege separation happens e.g. one Unix UID per application.<br /> ;Tom: Proxy [...] need to do some privilege checking that kernel otherwise does for you.<br /> ;Simo: A few key things: (1) How to handle permissions. How to know whether to give an application access to use a keytab.<br /> ;Greg: Have to have a policy...<br /> ;Greg: Almost all platforms can give you the UID of an IPC peer.<br /> ;Simo: Not necessarily wanting to rely on UID.<br /> ;Greg: Or use Unix file permissions.<br /> ;Simo: e.g. different subdirectory per keytab.<br /> ;Simo: (2) What do we want to proxy? Could proxy every mech or only individual mechs?<br /> ;Greg: Doing individual message stuff in-process? [...] might be some mech that needs access to long-term private creds for the process to use an imported context.<br /> ;Simo: Flag mech as proxiable?<br /> ;Greg: What about SPNEGO? What if some mechs are proxiable, while some are not? Maybe all-or-nothing?<br /> ;Simo: Could proxy, send actual secret in export to app.<br /> ;Greg: Inband renegotiation complications [ ... probably borrowing trouble as doing this tunneled over wrap tokens depends on application properties ] Could start simple: proxy everything. Then work on options to export back to the app.<br /> ;Tom: Proxy at mechglue layer, or at individual mechs? [ mechglue ]<br /> ;Simo: How to transport stuff through IPC [ encoding etc. ]<br /> <br /> We talk about TIRPC and complications thereof; best currently BSD-licensed version is probably from Linux NFS project.<br /> <br /> ==libverto==<br /> libev is probably the best back end to bundle.<br /> <br /> ;Simo: Embed whatever version you need.<br /> ;Greg: libverto expects to dynamically load.<br /> ;Simo: Rename stuff if needed. Try to embed.<br /> <br /> It turns out libev has a number of support things that might make embedding it easier anyway.</div>

TomYu