directory-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From kayyag...@apache.org
Subject svn commit: r1444494 - in /directory/site/trunk/content/apacheds/kerberos-ug: 1-kerberos.mdtext 1.1-introduction.mdtext
Date Sun, 10 Feb 2013 07:48:00 GMT
Author: kayyagari
Date: Sun Feb 10 07:48:00 2013
New Revision: 1444494

URL: http://svn.apache.org/r1444494
Log:
trivial editing

Modified:
    directory/site/trunk/content/apacheds/kerberos-ug/1-kerberos.mdtext
    directory/site/trunk/content/apacheds/kerberos-ug/1.1-introduction.mdtext

Modified: directory/site/trunk/content/apacheds/kerberos-ug/1-kerberos.mdtext
URL: http://svn.apache.org/viewvc/directory/site/trunk/content/apacheds/kerberos-ug/1-kerberos.mdtext?rev=1444494&r1=1444493&r2=1444494&view=diff
==============================================================================
--- directory/site/trunk/content/apacheds/kerberos-ug/1-kerberos.mdtext (original)
+++ directory/site/trunk/content/apacheds/kerberos-ug/1-kerberos.mdtext Sun Feb 10 07:48:00
2013
@@ -39,16 +39,16 @@ Notice: Licensed to the Apache Software 
 
 # 1 - What is Kerberos ?
 
-**Kerberos** is the result of an effort by the MIT, known as **Project Athena**. It started
in May 1983, and resulted in many internal version at the MIT, and finally, **Kerberos V4**
was openly released on January 1989. **Kerberos V5* is available since 1993.
+**Kerberos** is the result of an effort by the MIT, known as **Project Athena**. It started
in May 1983, and resulted in many internal versions at the MIT, and finally, **Kerberos V4**
was openly released in January 1989. **Kerberos V5* is available since 1993.
 
-**Kerberos** is a computer network authentication protocol, which provides a secure, SSO,
trusted third-party mutual authentication service.
+**Kerberos** is a computer network authentication protocol, which provides a secure Single
Sign On(SSO) based on a trusted third-party mutual authentication service.
 
-* It's secure because the user's password is never transmitted over the wire. **Kerberos**
uses **Tickets** which are negociated with the server, with a limited time to live.
+* It is secure because the user's password is never transmitted over the wire. **Kerberos**
uses **Tickets** which are negociated with the server, with a limited time to live.
 
-* It a SSO system as a ticket can be used by all the services for its duration. The services
can fully trust those tickets.
+* It is a SSO system, a single ticket can be used by all the services till its validity expires.
 
-* It's a trusted third party as all the users and services are managed by the **Kerberos**
server. 
+* It acts as a trusted third party cause all the keys of users and services are managed by
the **Kerberos** server. 
 
-* It's a mutual authentication system that guarantees not only that the user is who he is
pretending to be, but because each user has the guarantee that the services he accesses to
are the expected services.
+* It is a mutual authentication system that guarantees not only that the user is who he is
pretending to be, but also because each user is guaranteed that the services he has access
to are the expected services.
 
-**Kerberos** is widely used in the **Microsoft™** world, as all the authentications
on **Microsoft™** are done through this protocol.
+**Kerberos** is widely used in the **Microsoft™** world, as all the authentication
mechanisms on **Microsoft™** are done through this protocol.

Modified: directory/site/trunk/content/apacheds/kerberos-ug/1.1-introduction.mdtext
URL: http://svn.apache.org/viewvc/directory/site/trunk/content/apacheds/kerberos-ug/1.1-introduction.mdtext?rev=1444494&r1=1444493&r2=1444494&view=diff
==============================================================================
--- directory/site/trunk/content/apacheds/kerberos-ug/1.1-introduction.mdtext (original)
+++ directory/site/trunk/content/apacheds/kerberos-ug/1.1-introduction.mdtext Sun Feb 10 07:48:00
2013
@@ -35,37 +35,35 @@ Notice: Licensed to the Apache Software 
 
 # 1.1 - Introduction
 
-The **Kerberos** server is a part of the **Apache Directory Server** : it uses the **LDAP**
server as a backend, but has its own network layer. which makes it easy to install, compared
to other solutions where you have two components : an LDAP server on one side, and the Kerberos
Server on the other.
+The **Kerberos** server is a part of the **Apache Directory Server** : it uses the **LDAP**
server as a backend, but has its own network layer. which makes it easy to install, compared
to other solutions where you have two components : a backend(typically an LDAP server) on
one side, and the Kerberos Server on the other.
 
-We also have a complete configuration GUI in Studio, which allows administrators to tweak
their server in a convenient way.
+We also have decent GUI support for editing the configuration in Studio, which allows administrators
to tweak their server's functionality in a convenient way.
 
-The Kerberos provider for Apache Directory implements RFC 1510 and RFC 4120 , the Kerberos
V5 Network Authentication Service. The purpose of Kerberos is to verify the identities of
principals (users or services) on an unprotected network. While generally thought of as a
single-sign-on technology, Kerberos' true strength is in authenticating users without ever
sending their password over the network. Kerberos is designed for use on open (untrusted)
networks and, therefore, operates under the assumption that packets traveling along the network
can be read, modified, and inserted at will. This chart provides a good description of the
protocol workflow.
+The Kerberos server of Apache Directory implements RFC 1510 and RFC 4120, the Kerberos V5
Network Authentication Service. The purpose of Kerberos is to verify the identities of principals
(users or services) on an unprotected network. While generally thought of as a single-sign-on
technology, Kerberos's true strength is in authenticating users without ever sending their
passwords over the network. Kerberos is designed for use in open (untrusted) networks and,
therefore, operates under the assumption that packets traveling along the network can be read,
modified, and inserted at will. This chart provides a good description of the protocol workflow.
 
-Kerberos is named for the three-headed dog that guards the gates to Hades. The three heads
are the client, the Kerberos server, and the network service being accessed.
+Kerberos is named after the three-headed dog that guards the gates to Hades. The three heads
are the client, the Kerberos server, and the network service being accessed.
 
 ## What is it all about ?
 
-The isea is to have a server being able to deliver a user some tickets that can be used by
services. Those tickets are trusted for a certain period of time. The most important point
is that the service does not have to ask any server to validate those tickets : they are trusted
because they have been generated by a trusted server.
+The idea is to have a server being able to deliver a user some tickets that can be used by
services. Those tickets are trusted for a certain period of time. The most important point
is that the service does not have to ask any server to validate those tickets : they are trusted
because they have been generated by a trusted server.
 
-This is a two rounds process :
-1 - The client request a Ticket to the Kerberos server
-2 - The client submit the ticket to the requested service
+This is a two round process :
+1 - The client requests a Ticket to the Kerberos server
+2 - The client submits the ticket to the requested service
 
 The the client is authenticated.
 
-In any case, there is no way to fake an identity or to forge a ticket that can be used, nor
one can reuse a Ticket that has already been used.
+In any case, there is no way to fake an identity or to forge a ticket for accessing a service,
nor one can reuse a Ticket that has already been used.
 
 ## Apache Kerberos Server
 
-The Apache Directory Kerberos provider is implemented as a protocol-provider plugin. As a
plugin, the Kerberos provider leverages **Apache MINA** for front-end services and the **Apache
Directory** read-optimized backing store for persistent directory services.
+The Apache Directory Kerberos server uses **Apache MINA** in networking layer and the **Apache
Directory** as the backend
+for storing principals and associated keys.
 
-The Kerberos server for Apache Directory, in conjunction with MINA and the Apache Directory
store, provides an easy-to-use yet fully-featured network authentication service. As implemented
within the Apache Directory, the Kerberos provder will provide:
+The Kerberos server provides:
 
 * Authentication service
 * Ticket-granting service
-* Pre-authentication support
-* DES encryption systems
-* Triple-DES (DES3)
-* UDP and TCP Support (MINA)
-
-
+* Pre-authentication support(PA-ENC-TIMESTAMP)
+* support for des-cbc-md5, des3-cbc-sha1-kd, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
and rc4-hmac encryption systems
+* UDP and TCP transports
\ No newline at end of file



Mime
View raw message