Re: MEMORY credential cache interop between Heimdal and MIT?

[Ken Hornstein <kenh@cmf.nrl.navy.mil>]

>This is actually a fundamental problem with authentication mechanisms in
>general. It get's into the issue of how to manage credentials. Currently
>Kerberos uses disk files. That is clumsy and in some cases downright
>insecure. I have personally concluded that the proper solution is for
>the OS to provide a secure storage mechanism where a library can put
>arbitrary data that can by accessed using a key such as a simple number
>or preferably a string (e.g. 'krb5:MEMORY:') that may be accessed ONLY
>by the same pid or by a descendant (i.e. the storage is inherited).
>
>I'm not sure if this can be done entirely in userspace but if it could
>that would be an interesting project. Then you could have MEMORY: ccache
>and keytab interoperability and get around a lot of ugly environment
>variable / file hacks.

I actually implemented exactly this type of credential cache a few
years ago.  Mind you, since it was designed to be portable across
all variants of Unix it introduces it's own set of bizarro ugly
hacks.  It doesn't use the mmap() stuff that Thor mentioned (I was
not aware of that feature of mmap() at the time I wrote my credential
cache).  I think if you used mmap() you'd have to do some locking
which could complicate things, but I don't think it's an unsolvable
problem.

While it's relatively straightforward to develop a credential cache
which is only accessable to decendants of a master process, I was
unable to come up with a reasonable way of restricting access to
the credential cache to certain programs.  I am not convinced this
is a solvable problem; perhaps it is solvable with OS-specific
extensions, but I cannot see how to solve this problem in a portable
way.  The credential cache I developed solved a particular problem
we were having, and we've been using it in production for a number
of years.  But it's not a panacea for the generic problem of keeping
a bad guy away from my credentials.

(I have removed kitten from the cc: line; I do not belive this discussion
is in scope for that WG).

--Ken