Re: mod_auth_kerb and Heimdal KDC

[Daniel Kouril <kouril@ics.muni.cz>]

On Wed, Aug 21, 2002 at 08:20:30AM -0600, Tillman Hodgson wrote:
[...] 
> > We are using an apache module available from
> > http://meta.cesnet.cz/software/heimdal/index.en.html
> 
> Yes, that's the module that I'm using as well. Their patches for Mozilla
> and Apache look seriously interesting ... much better than the "dump the
> login page onto SSL" approach.

Just a remark to SSL:
The Microsoft draft (which the Mozilla+Apache patches are based on) specifies
only mechanims for authentication. Some another method (e.g. SSL) must be used 
to ensure integrity control of transmitted HTTP messages. Otherwise, a
malicious user would be able to copy an Authorization header (comming from a
valid user) and past it to another message.

--
Dan