> Sorry, I didn't really get that single-sign-on and federated authentication is the same thing.
I don't think it is. SSO is a good feature, and kerberos provides it -- but I was more curious about the more general case. A solid ldap daemon with easy-to-use ssl/tls covers most of the use-cases I was thinking of.
I don't really care much about "winning arguments" -- I'm just curious about the state of secure, working federated authentication. And the fact that it needs to grip rather deeply into the system, therefore it would be nice to have it in base. Linux generally has PAM in base -- for some that is considered bad, for some it is considered convenient. I'm not really interested in judging one way or the other.
> It might be that so few people actually used it that there's no one to maintain it.
Yeah, that's the feeling I got. And it would be worse to keep something that isn't properly maintained. I guess I'd hoped some openbsd'er would hammer out a robust token/ticket based scheme without many of the flaws of kerberos (ie: hardened implementation, proper/modern cryptography primitives combined in a proper modern way, no premature optimization). That'd probably be hopeless to get to work with windows AD though, so maybe there's only a very small set of people that would care.
I'd certainly like (from a technological standpoint, anyway) something like that, that took lessons from window's kerberos/ldap/dns-story, but made something free and robust (possibly with a patch for GINA for windows) -- that allowed stuff like secure encrypted network filesystems etc.
(Come to think of it, I think the fact that I'm sort of enamoured by the concept of NFSv4 with authentication and encryption delegated to kereberos is one of the reasons why I was so surprised/disappointed. Why have ZFS and NFS without v4 and auth/enc support? So beautiful on paper. I guess that basically leaves sshfs (as OpenAFS also requires(?) kerberos).
I'd really like to see a working distributed single-sign on, single sign-off system that support (optional) caching/offline use coupled with a filesystem that is mutually authenticated (client to server, server to client) also with caching and off-line use. But that is simpler than efforts that have gone before...).