DevProj 260: Investigate alternatives to our existing MIT Kerberos -- Final Report

Summary: we should maintain our own independent authentication system. There is no strong driver towards migration to EASE, and several good reasons not to. There is no obvious reason at the moment to migrate to Heimdal. It does makes sense to pool our resources with IS, so that we can share software versions where possible.

When DICE was first established, one of the decisions taken was to use (MIT) Kerberos as the authentication technology. This has been reliable and cheap to maintain ever since. However in 2013 a development project was started to review this authentication technology, for several reasons:

The project proceeded in three phases:

  1. Following discussion, an initial "pros and cons" document was created.
  2. A useful meeting was held with Kenny MacDonald to discuss his EASE upgrade plans.
  3. After the EASE upgrade had happened and bedded in, the pros and cons were again discussed, and CEG concluded that overall it would be better to stick with our own authentication infrastructure.

That being the case, we should continue to liaise with Kenny, with a view to sharing code and experience for our mutual benefit. In particular, we should aim for unified lcfg components, and we may be able to pick up his kerberos RPMs.

The final deliverable of the project was a summary conclusion document, giving the reasons for our decision re EASE in general terms, and with links to the project's home page and the Inf-unit's resilience document for those who might want to explore the details.

Although the project ran from early 2013 to early 2015, for much of this time it was effectively stalled to allow Kenny to perform the EASE upgrade and for us then to be able to evaluate any enhancements made in the way of principal management. Over the whole period the actual amount of development time expended was about 9 days.

The project's home page contains links to all of the working documents, to the summary conclusions, and to a number of useful outside sites.


$Id: FinalReport.html,v 1.12 2015/01/27 11:36:10 gdmr Exp $