Fundamental Kerberos/AD question

[brett_x]

Hi,
Background: I’m a system admin for our macs, but not for PCs or PC servers. I’m a kerberos noob. We have a bunch of Macs in our own happy OD world. We also live in AD, but don’t bind to it or anything. Our biggest problem is getting out to the internet because the AD controls access via an MS ISA proxy server. We have to authenticate to it to get anywhere outside the company. It works for the most part, but I’d like to explore easier processes for our users. We’re not using Kerberos in our OD implementation (besides what the OD Master/Replicas do with each other) currently, but will likely move towards it when we go to Leopard server/client if that matters.

I am wondering if there is a possibility to authenticate using Kerberos without binding our clients or servers to AD. I am hoping there might be a way to authenticate to AD and get a kerberos ticket that will be good for the day (wouldn’t that be double-sign on?). I’m not looking for a detailed explanation of how, just wondering if it is possible in theory.
Thanks,
Brett

[Author]

Posts