We have looked at Kerberos authentication support, but have not recieved a lot of customers asking for it. What would be the use case for supporting Kerberos? Is it SSO with Internet Explorer? Is Secure LDAP not enough of an authentication mechanism?
We are looking to leverage the Protected Users security group to harden high privilege accounts. Members of that group are unable to do the following:
Authenticate with NTLM authentication.
Use DES or RC4 encryption types in Kerberos pre-authentication.
Be delegated with unconstrained or constrained delegation.
Renew the Kerberos TGTs beyond the initial four-hour lifetime.
I don't know the exact mechanism employed when authenticating via LDAP over TLS, but I discovered that members of the Protected Users security group cannot authenticate to OneView.
I just checked the Event Log on the domain controller after attempting to log in and found this message in the related event: "NTLM authentication failed because the account was a member of the Protected User group."
In large environments (both Synergy and AD), managing certificates for LDAPS for every DC in a domain is not the best experience.
You already probably know, but Domain Controllers in an AD will evolve across time, new DC will appear, some other will disappears, certificates may be refreshed, and every single operation will impact every OneView server configured with AD authentication because of certificates and DC configuration management in OneView.
LDAP would solve the issue but would decrease security level, Kerberos integration can adress those points.
We don't have kerberos authentication on the roadmap yet. LDAPs / certificates make use of the customer's PKI infrastructure. Are you stating that PKI is less secure than Kerberos?
"Are you stating that PKI is less secure than Kerberos?": I've not written such a thing. I've written that LDAP (not LDAPS) would avoid the administration overhead of certificates stored in Oneview to manage LDAPS, but at the price of a lower security.
Kerkeros integration does not introduce such administration overhead, and keep a good level of security. But i note that there is not many requests from customers for this feature and this is a costly change in Oneview development workload, so this is still not in HPE OV roadmap.
