Subject: [KAML] RFC - Federated Authentication Token Translator

From: Chen Liang <[email-masked]>
Date: Thu, 10 Nov 2011 22:50:23 +0000

Hi,

This is Chen Liang. I'm a postgraduate research student in School of
Computing, Dublin Institute of Technology.

I would like to request for comment on the proposed design of my
research. It aims to address the issue of federated single sign-on for
web-based and non-web based services. After investigate related
approaches such as Project Mooonshot, SASL-SAML and Kerbero Secure
sharing. I propose a new simplified approach. It utilises the existing
SAML based federation and Kerberos single sign-on. It aims to enable
federated single sign-on for web-based and non-web based services. In
addition, it aims to enable the federated single sign-on without
modifying the service applications and their clients.

Please find the attachment for the detail document.

Thanks
Chen

--
Chen Liang
Mr
Bsc School of Computing Graduate
Dublin Institute of Technology
Kevin Street, Dublin 8
Dublin

---

From: Luke Howard <[email-masked]>
Date: Fri, 11 Nov 2011 11:48:38 +1100

> Computing, Dublin Institute of Technology.

How will this work with unmodified clients and servers? I'm having a bit of trouble getting my head around this.

In step 2, is the Kerberos ticket request for the token translator or for the remote desktop service?

-- Luke

---

From: Luke Howard <[email-masked]>
Date: Fri, 11 Nov 2011 12:09:43 +1100

So, there is no Kerberos cross-realm key between the two organisations? Won't this fail immediately because the first organisation's KDC will not be able to return a referral to the second? How do you plan to intercept this?

-- Luke