Strong Authentication - Revision history

JeffM2501 at 08:28, 10 February 2013

2013-02-10T08:28:03Z

← Older revision		Revision as of 08:28, 10 February 2013
Line 1:		Line 1:
			{{IdeaDesign}}

	{\|style="width:100%;margin-top:+1em;background-color:#FF0000;border:1px solid #ccc;"		{\|style="width:100%;margin-top:+1em;background-color:#FF0000;border:1px solid #ccc;"
	\|<div style="font-size:162%">'''Kerberos authentication was rejected as an implementation system as overly complex with no real benefit over the token system, this document is kept for historical reasons.'''</div>		\|<div style="font-size:162%">'''Kerberos authentication was rejected as an implementation system as overly complex with no real benefit over the token system, this document is kept for historical reasons.'''</div>
Line 32:		Line 34:

	If credentials are unmatched, you will be still logged as an untrusted user.		If credentials are unmatched, you will be still logged as an untrusted user.

	~~[[Category:Development]]~~

JeffM2501: mark as historically rejected.

2013-01-20T16:46:10Z

mark as historically rejected.

← Older revision		Revision as of 16:46, 20 January 2013
Line 1:		Line 1:
			{\|style="width:100%;margin-top:+1em;background-color:#FF0000;border:1px solid #ccc;"
			\|<div style="font-size:162%">'''Kerberos authentication was rejected as an implementation system as overly complex with no real benefit over the token system, this document is kept for historical reasons.'''</div>
			\|}



	To use strong auhentication on bzflag an infrastructure based on kerberos should be put in place.		To use strong auhentication on bzflag an infrastructure based on kerberos should be put in place.

TD-Linux: removed unnecessary tables; ws

2007-03-14T00:45:03Z

removed unnecessary tables; ws

← Older revision		Revision as of 00:45, 14 March 2007
Line 4:		Line 4:
	So you should write a /etc/krb5.conf on Unix or krb5.ini on windows, with the following content:		So you should write a /etc/krb5.conf on Unix or krb5.ini on windows, with the following content:

	{\|		[realms]
	\|
	[realms]
	BZFLAG.ORG = {		BZFLAG.ORG = {
	kdc = bryjen.bzflag.org		kdc = bryjen.bzflag.org
	admin_server = bryen.bzflag.org		admin_server = bryen.bzflag.org
	}		}
	\|}
	This is temporary and will be changed whenever we decide on where to put it.		This is temporary and will be changed whenever we decide on where to put it.

Line 23:		Line 21:
	When starting a client, it will authenticate to the server if the bzdb variable: username & password are defined (in the bzfs config file). So write the following lines on your config:		When starting a client, it will authenticate to the server if the bzdb variable: username & password are defined (in the bzfs config file). So write the following lines on your config:

	{\|
	\|
	set username yourName		set username yourName

	set password yourSecret		set password yourSecret
	\|}

	If credentials are unmatched, you will be still logged as an untrusted user.		If credentials are unmatched, you will be still logged as an untrusted user.

	[[Category:Development]]		[[Category:Development]]

Joevano: Formatting and spelling

2007-03-11T19:24:24Z

Formatting and spelling

← Older revision		Revision as of 19:24, 11 March 2007
Line 4:		Line 4:
	So you should write a /etc/krb5.conf on Unix or krb5.ini on windows, with the following content:		So you should write a /etc/krb5.conf on Unix or krb5.ini on windows, with the following content:

	~~---------~~		{\|
			\|
	[realms]		[realms]
	BZFLAG.ORG = {		BZFLAG.ORG = {
	kdc = bryjen.bzflag.org		kdc = bryjen.bzflag.org
	admin_server = bryen.bzflag.org		admin_server = bryen.bzflag.org
	}		}
	~~----------~~		\|}
	This is temporary and will be changed whenever we decide on where to put it.		This is temporary and will be changed whenever we decide on where to put it.

	On the kerberos database should be created one principal (kerberos user) for any client and one principal for any server that should ~~partecipate~~.		On the kerberos database should be created one principal (kerberos user) for any client and one principal for any server that should participate.

	* Server principal name should be #port/publicaddr@BZFLAG.ORG (like 5154/bzflag0.gamesunited.de@BZFLAG.ORG)		* Server principal name should be #port/publicaddr@BZFLAG.ORG (like 5154/bzflag0.gamesunited.de@BZFLAG.ORG)
	* Client principal name should be clientName@BZFLAG.ORG (like c3po@BZFLAG.ORG)		* Client principal name should be clientName@BZFLAG.ORG (like c3po@BZFLAG.ORG)

	When starting a public server it will try to authenticate using the value given in -port -publicaddr and -password		When starting a public server it will try to authenticate using the value given in -port -publicaddr and -password
Line 22:		Line 23:
	When starting a client, it will authenticate to the server if the bzdb variable: username & password are defined (in the bzfs config file). So write the following lines on your config:		When starting a client, it will authenticate to the server if the bzdb variable: username & password are defined (in the bzfs config file). So write the following lines on your config:

	~~------~~		{\|
	set username yourName		\|
			set username yourName
	set password yourSecret
	~~------~~		set password yourSecret
			\|}

	If credentials are unmatched, you will be still logged as an untrusted user.		If credentials are unmatched, you will be still logged as an untrusted user.

	[[Category:Development]]		[[Category:Development]]

Brad: add category

2007-02-20T22:53:55Z

add category

← Older revision		Revision as of 22:53, 20 February 2007
Line 29:		Line 29:

	If credentials are unmatched, you will be still logged as an untrusted user.		If credentials are unmatched, you will be still logged as an untrusted user.

			[[Category:Development]]

Brad: copy StrongAuthentication from old wiki

2007-02-20T06:49:37Z

copy StrongAuthentication from old wiki

New page

To use strong auhentication on bzflag an infrastructure based on kerberos should be put in place.

kdc: is the kerberos Key Distribution Center, part of the mit-kerberos5 distribution. It should be unique, possibly with a slave configured, and for bzflag to work it should be configured to serve the realm BZFLAG.ORG . Your system needs to know where KDC is.
So you should write a /etc/krb5.conf on Unix or krb5.ini on windows, with the following content:

---------
[realms]
BZFLAG.ORG = {
kdc = bryjen.bzflag.org
admin_server = bryen.bzflag.org
}
----------
This is temporary and will be changed whenever we decide on where to put it.

On the kerberos database should be created one principal (kerberos user) for any client and one principal for any server that should partecipate.

* Server principal name should be #port/publicaddr@BZFLAG.ORG (like 5154/bzflag0.gamesunited.de@BZFLAG.ORG)
* Client principal name should be clientName@BZFLAG.ORG (like c3po@BZFLAG.ORG)

When starting a public server it will try to authenticate using the value given in -port -publicaddr and -password

When starting a client, it will authenticate to the server if the bzdb variable: username & password are defined (in the bzfs config file). So write the following lines on your config:

------
set username yourName

set password yourSecret
------

If credentials are unmatched, you will be still logged as an untrusted user.