Projects/Documentation Tasks

This is an early stage project for MIT Kerberos. It is being fleshed out by its proponents. Feel free to help flesh out the details of this project. After the project is ready, it will be presented for review and approval.

Purpose

To keep track of the various tasks that need to be documented such as function documentation, administration, troubleshooting etc.

Matrix of Document-Type VS Intended Readership

Doc-type/Reader	Architectural Guide	Setup & Config of Kerberos	Admin & Operations of Kerberos	Custom Build	API Description	API Details
End-users
Architects
System Admins
Application Developers
GSSAPI Developers
Kerberos Developers

Application development

task	Proposed Author	Target Date	Reviewer	Reviewer Comments
Designing a new protocol, or extending existing one, to use GSS-API	NW
Choosing security API
GSS-API vs SASL vs KRB5	NW
A guide to the similarities and differences between Heimdal and MIT Kerberos API	NW
GSS-API
A basic introduction to GSS-API, making use of the sample client and server, with special attention paid to Kerberos-related GSS-API issues	NW
How to tell the GSS-API library on the client side where the existing Kerberos ticket cache is	NW
How to write mechanism-independent GSS-API code	NW
Acceptor naming - How to get servers to use any key in a keytab	GH	2012-03-01		DONE
A guide to GSS-API naming as compared to Kerberos principal naming	NW
Using IAKERB
Anonymous credentials	GH	2012-10-01
Delegating credentials	GH	2012-10-01
Available extensions	NW
Thread safety	KR
Validating the flags set on the connection to ensure things like mutual authentication, confidentiality, integrity, replay protection, and sequence protection
Developing plugins	GH	2012-03-08		ready for review
A guide to developing plugins				DONE
Overview of existing pluggable interfaces			ZT reviewed profile plugin	DONE
Krb5 library guide
A more advanced introduction to using the Kerberos libraries for initial authentication, focusing on the authentication steps, validating initial credential	TY	2012-04-27	need examples
Kerberos prompter behavior	NW
An introduction to ticket caches and keytabs and their corresponding APIs	KR			under review
An advanced guide to the pre-auth mechanisms, FAST
An advanced guide to the principal manipulation and parsing	TY	TBD
Thread safety	KR
Password change including the automatic internal support for password change on expired passwords if a prompter is provided
krb5_appdefault_* functions and their alternatives
MIT Kerberos features : quick facts	ZT	ongoing		DONE
How to build Kerberos from source	ZT			DONE

Administration

task	Proposed Author	Target Date	Reviewer	Reviewer Comments
Introduction to Kerberos system
Man page	TH	2012-08-15
General overview	TH	2012-08-15
Intro for admins	TH	2012-08-15
Technical overview	TH	2012-07-15		under review
Setting a new realm
Choosing backend: LDAP vs DB2
Replication	ZT			DONE
DNS configuration and SRV records - how they are used, in what order	KR
Reverse DNS	TY	2012-10-01
Choosing encryption types for principals	TY	2012-10-01
Integration Kerberos with Login System
Difference between real Kerberos authentication, Kerberos password verification on the server side, and "LDAP authentication" in a Kerberos environment
Validating Kerberos tickets
Clear text password over HTTPS	NW
Configuring with pam_krb5 module	NW
Storing/locating keytab
Cross-realm
cross-realm interaction with AD
Transitive trust
Referrals
Performance
Performance tuning tips
Performance tradeoffs
kadmin interface
Keying workstation/ host key setting
Using Smartcard with PKINIT
Kerberized ssh	NW
Configuration
Cross-realm and ssh
Selecting and configuring plugins	GH	2012-03-15		DONE
Anonymity support	GH	2012-10-01
A guide to principal naming basics and structure
Troubleshooting
Troubleshooting errors	ZT	ongoing
Trace logging	GH	2012-03-22		DONE
Realm renaming
Using LDAP server for Kerberos backend	ZT			Ubuntu 10.4 (lucid) DONE
Basic concepts (passwd policy, ticket )
Approaches to authorization -- centralized vs distributed, etc.
Acceptable date and time formats	ZT	2012-07-15		DONE
kadm5.acl man page	ZT	2012-08-15		DONE

API documentation

Most commonly used API functions (in alphabetical order)

Tier 1 - Highest priority

API	Proposed Author	Reviewer	Target Date	Reviewer Comments
krb5_build_principal [1]	ZT	GH
krb5_build_principal_alloc_va [2]	ZT	GH
krb5_build_principal_ext [3]	ZT	GH
krb5_cc_close [4]	ZT	GH
krb5_cc_default [5]	ZT	GH
krb5_cc_default_name [6]	ZT	GH
krb5_cc_destroy [7]	ZT	GH
krb5_cc_dup [8]	ZT	GH
krb5_cc_get_name [9]	ZT	GH
krb5_cc_get_principal [10]	ZT	GH
krb5_cc_get_type [11]	ZT	GH
krb5_cc_initialize [12]	ZT	GH
krb5_cc_new_unique [13]	ZT	GH
krb5_cc_resolve [14]	ZT	GH
krb5_change_password [15]	ZT	GH
krb5_free_context [16]	ZT	GH
krb5_free_error_message [17]	ZT	GH
krb5_free_principal [18]	ZT	GH
krb5_fwd_tgt_cred [19]	ZT	GH		Needs example
krb5_get_default_realm [20]	ZT	GH
krb5_get_error_message [21]	ZT	GH
krb5_get_host_realm [22]	ZT	GH
krb5_get_credentials [23]	ZT	GH
krb5_get_fallback_host_realm [24]	ZT	GH
krb5_get_init_creds_keytab [25]	ZT	GH
krb5_get_init_creds_opt_alloc [26]	ZT	GH
krb5_get_init_creds_opt_free [27]	ZT	GH
krb5_get_init_creds_opt_get_fast_flags [28]	ZT	GH
krb5_get_init_creds_opt_init [29]	ZT	GH
krb5_get_init_creds_opt_set_address_list [30]	ZT	GH
krb5_get_init_creds_opt_set_anonymous [31]	ZT	GH
krb5_get_init_creds_opt_set_canonicalize [32]	ZT	GH
krb5_get_init_creds_opt_set_change_password_prompt [33]	ZT	GH
krb5_get_init_creds_opt_set_etype_list [34]	ZT	GH
krb5_get_init_creds_opt_set_expire_callback [35]	ZT	GH
krb5_get_init_creds_opt_set_fast_ccache [36]	ZT	GH
krb5_get_init_creds_opt_set_fast_ccache_name [37]	ZT	GH
krb5_get_init_creds_opt_set_fast_flags [38]	ZT	GH
krb5_get_init_creds_opt_set_forwardable [39]	ZT	GH
krb5_get_init_creds_opt_set_out_ccache [40]	ZT	GH
krb5_get_init_creds_opt_set_pa [41]	ZT	GH
krb5_get_init_creds_opt_set_preauth_list [42]	ZT	GH
krb5_get_init_creds_opt_set_proxiable [43]	ZT	GH
krb5_get_init_creds_opt_set_renew_life [44]	ZT	GH
krb5_get_init_creds_opt_set_salt [45]	ZT	GH
krb5_get_init_creds_opt_set_tkt_life [46]	ZT	GH
krb5_get_init_creds_password [47]	ZT	GH
krb5_get_profile [48]	ZT	GH
krb5_get_prompt_types [49]	ZT	GH
krb5_get_renewed_creds [50]	ZT	GH
krb5_get_validated_creds [51]	ZT	GH
krb5_init_context [52]	ZT	GH
krb5_init_secure_context [53]	ZT	GH
krb5_is_config_principal [54]	ZT	GH
krb5_is_thread_safe [55]	ZT	GH
krb5_kt_close [56]	ZT	GH
krb5_kt_default [57]	ZT	GH
krb5_kt_default_name [58]	ZT	GH
krb5_kt_get_name [59]	ZT	GH
krb5_kt_get_type [60]	ZT	GH
krb5_kt_resolve [61]	ZT	GH
krb5_kuserok [62]	ZT	GH
krb5_parse_name [63]	ZT	GH
krb5_parse_name_flags [64]	ZT	GH
krb5_principal_compare [65]	ZT	GH
krb5_principal_compare_any_realm [66]	ZT	GH
krb5_principal_compare_flags [67]	ZT	GH
krb5_prompter_posix [68]	ZT	GH
krb5_realm_compare [69]	ZT	GH
krb5_recvauth [70]	ZT	GH
krb5_recvauth_version [71]	ZT	GH
krb5_set_default_realm [72]	ZT	GH
krb5_set_password [73]	ZT	GH
krb5_set_password_using_ccache [74]	ZT	GH
krb5_set_principal_realm [75]	ZT	GH
krb5_set_trace_callback [76]	ZT	GH
krb5_set_trace_filename [77]	ZT	GH
krb5_sname_to_principal [78]	ZT	GH
krb5_unparse_name [79]	ZT	GH
krb5_unparse_name_ext [80]	ZT	GH
krb5_unparse_name_flags [81]	ZT	GH
krb5_unparse_name_flags_ext [82]	ZT	GH
krb5_us_timeofday [83]	ZT	GH
krb5_verify_authdata_kdc_issued [84]	ZT	GH

We may want to have more examples for some of the common API functions.

Manpage proofreading

manpage	original	reviewer	comments
k5identity.5	src/gen-manpages/k5identity.M	GH
k5login.5	src/gen-manpages/k5login.M	GH
k5srvutil.1	src/kadmin/cli/k5srvutil.M	GH
kadmin.1	src/kadmin/cli/kadmin.M	GH
kadmind.8	src/kadmin/server/kadmind.M	GH
kdb5_ldap_util.8	src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.M	GH
kdb5_util.8	src/kadmin/dbutil/kdb5_util.M	GH
kdc.conf.5	src/config-files/kdc.conf.M	GH
kdestroy.1	src/clients/kdestroy/kdestroy.M	GH
kinit.1	src/clients/kinit/kinit.M	GH
kpasswd.1	src/clients/kpasswd/kpasswd.M	GH
kprop.8	src/slave/kprop.M	GH
kpropd.8	src/slave/kpropd.M	GH
kproplog.8	src/slave/kproplog.M	GH
krb5-send-pr.1	src/util/send-pr/send-pr.1		copyright issues. Removed from the documentation
krb5.conf.5	src/config-files/krb5.conf.M	GH
krb5kdc.8	src/kdc/krb5kdc.M	GH
ksu.1	src/clients/ksu/ksu.M	GH	needs rewrite
kswitch.1	src/clients/kswitch/kswitch.M	GH
kvno.1	src/clients/kvno/kvno.M	GH
sclient.1	src/appl/sample/sclient/sclient.M	GH
sserver.8	src/appl/sample/sserver/sserver.M	GH

Abbreviations

abbreviation	full names?
GH	Greg Hudson
KR	Ken Raeburn
MIT	MITKC group
NW	Nico Williams
TH	Thomas Hardjono
TY	Tom Yu
ZT	Zhanna Tsitkov