1. Moonshot, in a nutshell
SAML
IdP
Client
Server
AAA
EAP
RADIUS

2. Moonshot with SSH SAML IdP OpenSSH client OpenSSH server FreeRADIUS
AAA server
GSS EAP
over SSH
RADIUS
gss_authorize_localname() to authorise user
gss_pname_to_uid() if user is empty

3. Windows Domain Controller
Moonshot with CIFS
Windows Domain Controller
Protocol
Transition
(S4U2Self)
Samba4
client
Samba4
file server
FreeRADIUS
AAA server
GSS EAP
over CIFS
(SPNEGO)
RADIUS
(+PAC)
gss_get_name_attribute(“urn:mspac:”)
gss_inquire_sec_context_by_oid(GSS_C_INQ_SSPI_SESSION_KEY)

4. Moonshot with LDAP SAML IdP OpenLDAP client OpenLDAP server FreeRADIUS
access to attrs=eduPersonEntitlement
        by dynacl/gss/eduPersonAffiliation=faculty write
        by * read
OpenLDAP
client
OpenLDAP
server
FreeRADIUS
AAA server
GSS EAP
Over LDAP
(SASL)
RADIUS
(+SAML)
Shibboleth
gss_get_name_attribute(“eduPersonEntitlement”)

5. Kerberos with SAML Kerberos KDC SAML IdP OpenLDAP client OpenLDAP
TGS-REQ
OpenLDAP
client
OpenLDAP
server
Kerberos
over LDAP
(SASL)
Shibboleth

6. signs assertion with Kidp
Moonshot with Kerberos delegation
FreeRADIUS AAA server
SAML IdP
signs assertion with Kidp
RADIUS
Firefox
Apache
server
Kerberos
(SASL)
IMAP
server
GSS EAP
over HTTP
Negotiate
Protocol
Transition
(S4U2Self)
Kerberos KDC
verifies assertion and re-signs
with ticket session key

7. Moonshot with Kerberos delegation: The gory details
C authenticates to S1 using GSS EAP
S1 makes PT request with SAML assertion in authorization data
KDC verifies assertion signed with Kidp
KDC re-signs assertion with Ksession, and authorization data with Ktgs
KDC issues ticket (C, S1)
S1 makes constrained delegation request for S2 using (C, S1)
KDC verifies assertion signature
KDC issues ticket (C, S2) containing re-signed assertion (Ksession)
S1 authenticates using Kerberos to S2 (AP-REQ)
S2 verifies assertion signature with Ksession
S2 retrieves assertion from authorization data
S2 performs attribute-based authorization of C

8. Patches Cyrus SASL MIT Kerberos Heimdal Samba OpenSSH
GS2 plugin integrated (apparently)
MIT Kerberos
In master but not shipped
MIT 1.8 and 1.9 should work with some features missing
Heimdal
In master but not reviewed/shipped
Probably no shipped versions will work because mechglue loader is broken
Samba
In progress
OpenSSH
In Moonshot repository but not integrated upstream
OpenLDAP, Jabber server, Adium, etc
Use SASL, no changes required
ACL plugin in contrib/ in master

9. MIT S4U GSS APIs gss_acquire_cred_impersonate_name
Allows a service to get a ticket to itself for an arbitrary user
S4U2Self
gss_accept_sec_context
Always returns a delegated handle
If the client did not provide a TGT, will do “constrained delegation”