[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-announce
Subject:    Linux-Announce Digest #988
From:       Digestifier <Linux-Announce-Request () senator-bedfellow ! mit ! edu>
Date:       2004-12-22 13:13:05
Message-ID: 20041222181305.10417.qmail () senator-bedfellow ! mit ! edu
[Download RAW message or body]

Linux-Announce Digest #988, Volume #4          Wed, 22 Dec 2004 13:13:05 EST

Contents:
  Release 0.1.3 from the Hurderos Project. (g.w@hurderos.org)

----------------------------------------------------------------------------

Date: Wed, 22 Dec 2004 05:27:57 CST
From: g.w@hurderos.org
Reply-To: g.w@hurderos.org
Subject: Release 0.1.3 from the Hurderos Project.

Good morning to everyone and Seasons Greetings.

With special appreciation to the MIT Kerberos Community the Hurderos
Project is pleased to announce Version 0.1.3 of its Single-Identity
Services and Authorization management system.

This release implements an extensible plug-in architecture for the MIT
Kerberos distribution which allows feature and functionality
enhancements without the need for source level modifications to the
source distribution itself.  Additional information is provided below
on this functionality.

Useful links are as follows:

        Source:          ftp://ftp.hurderos.org/pub/Hurderos/src
        Binaries:        ftp://ftp.hurderos.org/pub/Hurderos/binaries
        WEB:             http://www.hurderos.org

Significant changes between the 0.1.2 and 0.1.3 release are included
at the end of this note.

The objective of the Hurderos Project is to provide an OSS based
Open-Architecture system for managing user identities and services to
be delivered to those identities.  One of the primary goals is to
provide a rich architecture and support API to make Linux an
attractive platform for Independent Software Vendors (ISV's).

Hurderos is based on a unique identity model known as IDfusion.  This
model establishes a new paradigm for addressing the fundamental
question of what an electronic identity actually is and a method for
deriving service specific identities which characterize each users
presentation of a service.  An important side-effect of this model is
that it establishes an inherent cryptographic guarantee for directory
services which makes the authorization information in the directory
robust in the face of directory compromisse.

>From the perspective of ISV's IDfusion provides an inherent identity
mapping functionality which allows the mapping of authentication
identities to application specific identities.  This allows existing
applications to leverage the capabilities of Hurderos identity
management, authorization and service provisioning without major
modifications to applications other than the use of the KerDAP API
provided by Hurderos.

In contrast to proprietary solutions such as Active Directory the
Hurderos system provides an Open-Architecture management system which
is explicitly designed not to tie organizations to a particular server
or application architecture.  This release focuses on this goal by
providing an Open-Architecture system for Kerberos based authorization
systems.

As noted above this release provides an initial implementation of an
extensible plug-in architecture for the MIT Kerberos source
distribution.  The goal is to allow enhanced functionality such as
encapsulation of authorization information in the optional payload
section of Kerberos tickets without the need for source level
modifications to the distribution.

The 0.1.3 plug-in allows replacement or functionality enhancements in
the following areas:

        1.) AS_REQ
        2.) AS_REQ authorization payload generation
        3.) TGS_REQ
        4.) TGS_REQ authorization payload generation
        5.) Password change/modifications

In addition to a plug-in implementing IDfusion based authorization
payloads the 0.1.3 distribution provides a sample plug-in for testing
purposes.  This plug-in logs messages when fullfillment hooks are
called and provides a starting point for users who wish to write their
own enhancements.

Organizations who are implementing password synchronization systems
will find the Password hook provided to be particularly useful.  By
intercepting password modifications at the database level the hook
provides an effective system for capturing password modifications
implemented through a variety of avenues including kadmind,
kadmin.local and kpasswd.

This release also provides a client/server application demonstrating
the implementation of ticket based authorization payloads using this
infra-structure.

The Hurderos Project would like to thank the MIT Kerberos team for all
their hard work in providing the reference implementation of Kerberos
to the user community.  Their suggestions helped shape the design and
implementation of this extension architecture.  Our hope is for
continued collaboration so that these enhancements can eventually make
it into the mainline distribution.

0.1.2 -> 0.1.3 Changes ----------------------------------------------------
        * Implemented generic plug-in architecture for MIT Kerberos to
          support functionality extensions through dynamic shared
          libraries.

        * Implemented Hurderos/Krb5 plug-in to provide directory based
          control over ticket generation and to implement imbedding
          of authorization identities into Ticket-Granting and Service
          tickets.

        * Implemented build of modified MIT Kerberos distribution inside
          Hurderos source tree.

        * Updated and validated to version 2.6.0 of Xerces XML parser.

        * Added std namespace declarations to SPL to enable compilation
          under gcc 3.x.  Also cleaned up header definitions to
          improve C++ compiles.

        * Fixed login initialization so that the user for which the secured
          conduit is established for is taken from the User field on the
          Login panel.

        * Converted KerDAP library to use function calls based on
          an Identity type as the first arguement to the function.

        * Removed krb5_kt_register call from hurdmksvc.  Version 1.3.x API
          has problems with pre-rexisting keytabs.

        * Added patches to support Hurvice service authorization directives 
          for Apache2 mod_auth_pam.

        * Implemented KerDAP_Identity_KRB5_Search and KerDAP_KRB5_Search to
          locate users based on a Kerberos identity.

        * Implemented KerDAP_KRB5_Enabled to test whether or not Kerberos
          service is enabled for an identity.

        * Implemented support for modifying characteristics of service
          instance identities.

        * Implemented support for changing the status of service instance
          identities in GOOII.

        * Updated auth-krb5.c to support lookups of KERBEROS service and
          to check status of the KERBEROS service.

        * Removed memory leaks from ldap.c.  LDAP identity destructor now
          unbinds from the server.

        * Implemented hurdserver and hurdclient utilities for testing and
          prototyping of Hurderos service authorization identities in
          Kerberos tickets.

        * Updates to KerDAP library to handle creation and marshalling of
          Kerberos service authorization structures containing Hurderos
          service identities.

        * Updated build system to patch, compile and install Kerberos as a
          pre-requisite.

        * Implemented basic skeleton for a SHIBBOLETH service plug-in for
          ISME.  Updated Hurderos schema to support the service identity
          object.

        * Added sample Kerberos kdc.conf to illustrate syntax for
          specifying realm specific plug-ins.

        * Modified clean command for Kerberos internal header directory to
          initialize header files to zero length.

        * Removed commented out test values from demo_load.sql.

        * Added documentation to the INSTALL file detailing how to
          configure the modified Kerberos distribution.  Included
          instructions on how to modify the kdc.conf file to use the
          null test plug-in.
===========================================================================

Best holiday wishes to everyone.


As always,
GW
==============================================================================
                         The Hurderos Project
         Open Identity, Service and Authorization Management
                       http://www.hurderos.org

##########################################################################
# Send submissions for comp.os.linux.announce to: cola@stump.algebra.com #
# PLEASE remember a short description of the software and the LOCATION.  #
# This group is archived at http://stump.algebra.com/~cola/              #
##########################################################################


------------------------------


** FOR YOUR REFERENCE **

The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:

    Internet: Linux-Announce-Request@NEWS-DIGESTS.MIT.EDU

You can submit announcements to be moderated via:

    Internet: linux-announce@NEWS.ORNL.GOV

Linux may be obtained via one of these FTP sites:
    ftp.funet.fi				pub/Linux
    tsx-11.mit.edu				pub/linux
    sunsite.unc.edu				pub/Linux

End of Linux-Announce Digest
******************************
[prev in list] [next in list] [prev in thread] [next in thread]