Re: JAVA Support

On Sep 28, 2006, at 9:35 PM, Tom Lane wrote:

> "Joshua D. Drake" <jd@commandprompt.com> writes:
>> Is there any reason why we haven't built a generic authentication  
>> API?
>> Something like PAM, except cross platform?
>
> We're database geeks, not security/crypto/authentication geeks.  What
> makes you think we have any particular competence to do the above?
>
> Actually, the part of this proposal that raised my hackles the most  
> was
> the claim that GSSAPI provides a generic auth API, because that was
> exactly the bill of goods we were sold in connection with PAM.  (So  
> why
> is this our problem at all --- can't you make a PAM plugin for it??)
> It didn't help any that that was shortly followed by the lame  
> admission
> that no one has ever implemented anything except Kerberos  
> underneath it.
> Word to the wise, guys: go *real* soft on vaporware claims for auth
> stuff, because we've seen enough of those before.

Well, that's why I was pushing SASL instead of GSSAPI.  There are  
multiple mechanisms that are actually in use.

PAM turned out not to be sufficiently specified for cross-platform  
behavioral compatibility, and it only does password checking anyway.   
Calling it a security solution is a big overstatement IMO.  I guess a  
lot of people use PAM with SSL and don't worry about the gap between  
the two (which SASL or GSSAPI close).

In defense of GSSAPI non-Kerberos mechanisms do exist.  They just  
cost money and they aren't very cross-platform.  AFAIK GSSAPI has no  
simple password mechanisms.

There's a Microsoft-compatible SPNEGO mechanism for GSSAPI that's  
being implemented fairly widely now, but it's just a sub-negotiation  
mech that lets you choose between a Kerberos 5 (that's practically  
identical to the direct one), and NTLM.  If you allow NTLM you'd  
better limit it to NTLMv2!

------------------------------------------------------------------------ 
----
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz@jpl.nasa.gov, or hbhotz@oxy.edu