Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports constrained delegation in the GSS-API layer and Heimdal doesn't yet, and that Heimdal has a --with-openssl config option that makes it easy to use a version of OpenSSL other than the system default. Either can be worked around. I've found mailing list comments suggesting that Heimdal's thread safety is better, but they are fairly dated.

share|improve this question
I suspect but cannot prove there are still political concerns. For instance despite MIT being now free to distribute K online, export to the seven (eight?) watchlist nations is probably still illegal (or at least problematic) whereas people in those embargoed countries could get heimdal without those difficulties. – adric Jan 13 '14 at 19:20
True, it's not completely freely exportable, just much much more so than in the 1990s.…… The still embargoed countries are (I think) Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria (though also I've seen lists which omit Iraq ans Libya - the US government page cited is 404 and I haven't bothered to track down where it moved to) – armb Jan 14 '14 at 8:57

In my case, part of the answer turns out to be "Heimdal's kadmin supports adding constrained delegation attributes, MIT doesn't support constrained delegation with the default backend and requires you to modify the LDAP database directly if you use the LDAP backend".

I'd still be interested in learning of other people's opinions or experiences.

share|improve this answer
On the other hand, MIT still has regular releases, Heimdal's last public one was 2012 - cf. – armb Feb 5 at 10:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.