I've noticed that with most browsers the user needs to manually configure their browser to tell it to delegate credentials to certain hosts:
http://www.grolmsnet.de/kerbtut/credentialsdelegation.html If the user does not do so, they tend to get a fairly unhelpful message back from the server ("authorization denied", etc). Has there been any consideration given to including an HTTP authorization header that amounts to "the server would like you to delegate your credentials in order to proceed", so that web browsers could prompt users for permission (with a suitably scary warning) rather than the user having to figure out what setting to fiddle with? Ideally this prompt could even include a duration dialog, so the browser could fetch time-limited tickets (say, 30 seconds or so) and send those to the sever instead of the 10+ hour TGT (this would be ideal for something like mod_waklog). - a -- PGP/GPG: 5C9F F366 C9CF 2145 E770 B1B8 EFB1 462D A146 C380 ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos