2

As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?

Improve this question
1
  • Can you explain what you mean? I am used to Kerberos using the term "attributes" to identify flags set on principals in the realm/database. What do you mean by access segmentation within a device, and are you really trying to do this via attribute flags on principals?
    – Jacob
    Commented Mar 8, 2017 at 22:47

1 Answer 1

Reset to default
1

Microsoft has no SDK/API to change the kerberos protocol, and it wouldn't be a small feat to reimplement kerberos on both sides (client and server) as an authentication package.

I think you are missing a key point with your use case, kerberos is an authentication protocol, as such it should only deal with checking that you are who you say you are, network location isn't part of that. what you require is authorization, this is abstracted away from kerberos as a security measure and it is a bad idea to change that.

what you can do is change the authorization part - on the Domain Controller you can decide which user is allowed to login to which computer (or a OU of devices) using group policy. if this is for your specific application you can always implement it at that level.

another way is to create a site per subnet and allow logon to each user per site. look here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .