As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?

  • Can you explain what you mean? I am used to Kerberos using the term "attributes" to identify flags set on principals in the realm/database. What do you mean by access segmentation within a device, and are you really trying to do this via attribute flags on principals? – Jacob Mar 8 '17 at 22:47

Microsoft has no SDK/API to change the kerberos protocol, and it wouldn't be a small feat to reimplement kerberos on both sides (client and server) as an authentication package.

I think you are missing a key point with your use case, kerberos is an authentication protocol, as such it should only deal with checking that you are who you say you are, network location isn't part of that. what you require is authorization, this is abstracted away from kerberos as a security measure and it is a bad idea to change that.

what you can do is change the authorization part - on the Domain Controller you can decide which user is allowed to login to which computer (or a OU of devices) using group policy. if this is for your specific application you can always implement it at that level.

another way is to create a site per subnet and allow logon to each user per site. look here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.