Projects/Credential Store extensions

This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.

This project is about adding a set of extensions to GSSAPI to more easily handle credentials in a mechanism agnostic way.

Background

During the development of the GSS-Proxy project in connection with the Projects/ProxyGSSAPI project it became evident that the application implementing the proxy needs to be able to be configured to use different credentials depending on what application is connecting to the proxy. Using the normal defaults of GSSAPI is not possible because the proxy application does not run in the same security context as the proxied application and it may run multiple concurrent tasks on behalf of different applications with different trust/credentials.

A method to pass a set of default credentials to use on behalf of these application is necessary. This method should not be mechanism specific, as the proxy tries to be mechanism agnostic as much as possible.

In this light a 'Credential Stores' Extension has been proposed on the Kitten IETF Mailing list.

Requirements

• Abstract interface to pass credential store configuration to GSSAPI mechanisms.
• The credentials need to be specified in configuration files so no security sensitive information (like passwords) must be exposed there.
• Mechanisms can define their own key/value pairs
• New Key/Value pairs can be easily added in future
• The actual API need not to know how to interpret Key/Value pairs, they are passed directly to mechanisms

Architecture

The exposed public functions are paired with an analogous one in the mechglue SPI to give mechanisms access to the Credentials Store. The implementation provides functions only for mechanisms for which it makes sense, initially krb5 but not SPNEGO