Subject: [LON-CAPA-dev] Kerberos

From: Mark Lucas <[email-masked]>
Date: Sat, 26 Oct 2002 13:42:50 -0400 (EDT)

Hi-

	I've got some questions about desirable default behavior for 
kerberos.

	We are using kerberos 5. We also have a lowercase default domain
(oak_cell).

	The default behavior is to choose kerberos4 and to build a default 
domain (capitalized) out of the server name. Doesn't work well for me.

	The goal, of course, is to have the instructors not have to think 
about it at all. The proper default version for a site (say 5 and 
oak_cell) should not change.

	My proposal:

(1) I have added two variables: lonDefKrbVer and lonDefKrbDom to the
    loncapa.conf (default version is either 4 or 5 and default domain
    would be oak_cell for us)

(2) The version is checked accordig the default. If no default, then
    it is selected as 4.

(3) The default domain overrides the IPname derived default domain

(4) I would place a common routine in loncommon that returns the
    default kerberos domain.

(5) I want a mechanism to turn off the auto-capitalization. Should
    this be turned off by default now? Especially with the ability to
    hand set the domain appropriate default?

Suggestions? I have about half of this implemented. Let me know if I 
should go in a different direction.

About Kerberos, how common are the defaults? (as per capitalization, etc.)
(I was handed the oak_cell default domain by our central computer people - 
Is there a way to set an alias for this? For example, OHIOU.EDU)

					Thanks!
					     Mark
----------------------------------------------------------------------------
Mark Lucas					email: [email-masked]
252D Clippinger Lab  				phone: (740)597-2984
Department of Physics and Astronomy             fax:   (740)593-0433
Ohio University
Athens, OH 45701

---

From: Gerd Kortemeyer <[email-masked]>
Date: Sat, 26 Oct 2002 14:53:37 -0400

Hi Mark,

>     would be oak_cell for us)

Actually, while this would work, it is somewhat against the philosophy of the
server network.

The idea is that a person can log into any server in the network and (after
maybe changing the domain on the very login screen) find the exact same
environment.

loncapa.conf is machine specific. I very much like your above entries, though,
but I would suggest to add to hosts.tab, so that the information is available on
all machines. Fields would be added to one of the entries for a machine out of
ohiou, just like we currently do with the domain plaintext description. I would
suggest to add the fields

  :krb5:oak_cell

or for MSU

  :krb4:MSU

For another domain (again generalizing your idea), it could be any other
mechanism we currently or in the future support for authentication. One could
even consider putting in there

 :internal:D4F4421

where "D4F4421" is the salted standard first-login password. In essence, both of
those fields together could be the default passwd-file entries for somebody in
the respective domain.

- Gerd.

---

From: Gerd Kortemeyer <[email-masked]>
Date: Sat, 26 Oct 2002 14:58:40 -0400

Gerd Kortemeyer wrote:

> In essence, both of

While we are at it, we might even get rid of the awkwardness that in CUSR and
"Enroll single student" one HAS to put in an authentication mechanism, even if the
user already exists.

- Gerd.

---

From: Guy Albertelli II <[email-masked]>
Date: Mon, 28 Oct 2002 01:31:01 -0500 (EST)

Hi Gerd,

> suggest to add the fields

I have got to say this make me severally cringe.

Not that lonDefDomain makes me happier.

Currently if you login into machine in domain X with domain Y for
class in domain Z, and try to Enroll a student, when you click on the
Kerbersos option the kerberos info is based off of X

So currently it does ignore any suggestion of network transparency.

Additionally hosts.tab is only for specifying what a machine looks
like in the network. Throwing login information in there seems to be
growing its role in the system, and it is already hard enough to keep
that file updated for accuracy.

I would prefer a new .tab file in /home/httpd/lonTabs, maybe one for
each login type, specifying a domain's default login info

kereberos.tab:
msu:krb4:MSU.EDU
ohiou:krb5:oak_cell

Etc.

-- 
[email-masked]          BM: n^20 t20 z20 qS 
Guy Albertelli -7-7-7-  O-
    Two? Na.

---

From: Gerd Kortemeyer <[email-masked]>
Date: Mon, 28 Oct 2002 08:49:42 -0500

> Not that lonDefDomain makes me happier.

Yep, same problem as the Kerberos-proposal. Changing this one at this point in time
*MIGHT* be hard.

> each login type, specifying a domain's default login info

That looks good. Maybe domain-description should go into that file, too. A new file
"domains.tab" with the domain descriptions and the above info?

- Gerd.

---

From: "B. Minaei" <[email-masked]>
Date: Mon, 31 Mar 2003 11:36:04 -0500

http://www.theinquirer.net/?article=8629

---

From: Gerd Kortemeyer <[email-masked]>
Date: Mon, 31 Mar 2003 11:37:51 -0500

Interesting article. I know that Julika Mimkes from Oldenburg was 
trying to get LON-CAPA to work with SUSE, but I think she gave up 
eventually.

On Monday, March 31, 2003, at 11:36  AM, B. Minaei wrote:

> _______________________________________________
> LON-CAPA-dev mailing list
> [email-masked]
> http://mail.lon-capa.org/mailman/listinfo/lon-capa-dev