Mailing-List: contact kerby-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: kerby@directory.apache.org
From: "Zheng, Kai" <kai.zheng@intel.com>
To: "kerby@directory.apache.org" <kerby@directory.apache.org>,
	"dev@directory.apache.org" <dev@directory.apache.org>
Subject: RE: Kerby Update
Thread-Topic: Kerby Update
Thread-Index: AdNLnUttMAcVZJA2R8qxKm53saU4QgACpVtwAAALmpA=
Date: Mon, 23 Oct 2017 02:39:39 +0000
Message-ID: <8D5F7E3237B3ED47B84CF187BB17B66662B95E0B@SHSMSX103.ccr.corp.intel.com>
References: <9037BCED616A964EB486B12FCA9DCFCF3BD6A28B@shsmsx102.ccr.corp.intel.com>
 <8D5F7E3237B3ED47B84CF187BB17B66662B95DBE@SHSMSX103.ccr.corp.intel.com>
In-Reply-To: <8D5F7E3237B3ED47B84CF187BB17B66662B95DBE@SHSMSX103.ccr.corp.intel.com>
Accept-Language: en-US
Content-Language: en-US
dlp-product: dlpe-windows
dlp-version: 11.0.0.116
dlp-reaction: no-action
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
archived-at: Mon, 23 Oct 2017 02:39:56 -0000

+ Directory.

Regards,
Kai

-----Original Message-----
From: Zheng, Kai [mailto:kai.zheng@intel.com]=20
Sent: Monday, October 23, 2017 10:38 AM
To: kerby@directory.apache.org
Subject: RE: Kerby Update

Cool!!

Thanks Jiajia & Frank for working on this this, cross realm trust support! =
I thought this makes Kerby a much further step, towards a decent and standa=
lone Kerberos implementation.

-----Original Message-----
From: Li, Jiajia [mailto:jiajia.li@intel.com]=20
Sent: Monday, October 23, 2017 9:22 AM
To: kerby@directory.apache.org
Subject: Kerby Update

Hi all,

Recently we have implemented the cross-realm authentication support, KDC in=
 one realm can authenticate users in a different realm, so it allows client=
 from another realm to access the cluster. Cross-realm authentication is ac=
complished by sharing a secret key between the two realms. In both backends=
 should have the krbtgt service principals for realms with same passwords, =
key version numbers, and encryption types. We have used this feature in Had=
oop cluster, after establishing cross realm trust between two secure Hadoop=
 clusters with their own realms, copying data between two secure clusters c=
an work now. And this support also can be used to build trust relationship =
with MIT Kerberos KDC and we have tested compatibility.

Here is the document about setting up cross realm:
https://github.com/apache/directory-kerby/blob/trunk/docs/cross-realm.md

Thanks,
Jiajia