On Mon, Jun 26, 2006 at 04:12:39PM +0100, Ewan Mellor wrote:
> On Sun, Jun 25, 2006 at 04:49:03PM +0100, Daniel P. Berrange wrote:
> > * What is the motivation for implementing an explicit login_with_password
> > method rather than utilizing the existing HTTP authentication protocols ?
>
> We discussed this on xen-devel last week -- HTTP auth doesn't seem to be
> widely supported, so we didn't want to rely upon it. Also, this way we can
> use the XML-RPC over something other than HTTP (such as a raw unix domain
> socket).
>
> > The proposed login API utilizing a simple username/password pair is quite
> > limiting, preventing the use of any of the more advanced authentication
> > protocols such as challenge/response, public / private key, kerberos
> > ticket passing.
> >
> > The latter would be particuarly important if the apps using this API want
> > to integrate with any kind of single sign on system. Perhaps it would be
> > possible to define a more advanced login process which could be backed by
> > something like SASL
> >
> > http://www.ietf.org/rfc/rfc2222.txt
> > http://asg.web.cmu.edu/sasl/
>
> What would be involved in making this work? The username / password is
> already a step up for Xen -- how complicated is SASL or similar?
I'm not familiar enough with it to give any estimates on work involved, but
it would definitely be more complex than user/password, however, this is to
be expected given the much broader capabilities. There's fairly comprehensive
docs in the Cyrus SASL source distribution, for example,
http://www.indelible.org/php/sasl/cyrus-sasl/programming.html
Another possibility would be to integrate with PAM, fully supporting the
conversation function callbacks
Regards,
Dan.
--
|=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=|
|=- Perl modules: http://search.cpan.org/~danberr/ -=|
|=- Projects: http://freshmeat.net/~danielpb/ -=|
|=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|
_______________________________________________
xen-api mailing list
xen-api@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-api
|
Home