What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports constrained delegation in the GSS-API layer and Heimdal doesn't yet, and that Heimdal has a --with-openssl config option that makes it easy to use a version of OpenSSL other than the system default. Either can be worked around. I've found mailing list comments suggesting that Heimdal's thread safety is better, but they are fairly dated.

  • I suspect but cannot prove there are still political concerns. For instance despite MIT being now free to distribute K online, export to the seven (eight?) watchlist nations is probably still illegal (or at least problematic) whereas people in those embargoed countries could get heimdal without those difficulties. – adric Jan 13 '14 at 19:20
  • True, it's not completely freely exportable, just much much more so than in the 1990s. en.wikipedia.org/wiki/… en.wikipedia.org/wiki/… The still embargoed countries are (I think) Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria (though also I've seen lists which omit Iraq ans Libya - the US government page cited is 404 and I haven't bothered to track down where it moved to) cryptolaw.org/cls2.htm#us_terror – armb Jan 14 '14 at 8:57

In my case, part of the answer turns out to be "Heimdal's kadmin supports adding constrained delegation attributes, MIT doesn't support constrained delegation with the default backend and requires you to modify the LDAP database directly if you use the LDAP backend".

I'd still be interested in learning of other people's opinions or experiences.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.