Subject: SASL y Kerberos y GSSAPI

From: "Joshua Gramlich" <[email-masked]>
Date: Fri, 22 Nov 2002 14:01:59 -0600

Hello,

I am part of a group that has been tasked to add grid-ley security mechanisms to an application we maintain at a large research organization.  Pardon my vagueness, I will hopefully be able to speak more later.  Suffice it to say we have a large pile of data that is accessed by many users around the world...on the order of 1000 or so, from many disparate locations.

The desire of our community is to maintain current security practices (Kerberos 5) but allow outsiders in using the GSSAPI.  Our community's security mavens have suggested we user SASL as a go-between the two mechanisms.

Unfortunately, I don't even know if I'm even asking the correct questions.  I'll try to explain a bit more.

The pieces of our application communicate via corba and http.  We would like to secure all of these connections, locally with Kerberos, remotely via GSSAPI.  Transmitting passwords, cleartext or through an SSL connection is not acceptible to the community.

I've been looking for a good abstract of how SASL works, and how it interacts with Kerberos and GSSAPI.

Any ideas any of you can pass along?

Joshua Gramlich