FreeTDS Development Group

["Mark H. Wood" <mwood AT IUPUI.Edu>]

On Wed, 30 May 2001, James K. Lowden wrote:
[snip]
> IIRC, PDCs have themselves some sort of trusted domain, such that if
> client C is authenticated by PCD P1 and wants to connect to (log
> into) server S, then S and C do not both have to use P1 for
> authentication.  S may be in another domain controlled by PDC P2,
> and P1 and P2 have some mumble mumble arrangement to cross manage
> authentication or whatever you'd call it.

The term of art you're searching for is "trust".  Inter-domain trusts
don't really form a namespace as domain membership does; each trust is
an isolated agreement on a secret shared among DCs in some pair of
domains.  You put the same initial password into a DC in each domain,
and they recognize each other and then generate a new password
(replaced automagically at intervals).  That means they can open
secure channels to each other.  The other part of an inter-domain
trust is the trusting DCs' knowledge that they are permitted to pass
credentials through to the trusted DCs and rely on those DCs' responses.

(Domain membership is quite similar, I think:  members trust the DCs
in pretty much the same way that DCs trust each other.  The main
difference seems to be the use of a regular domain user account
(suitably privileged) as a trusted introducer, rather than the more
arms'-length approach used between domains.  That, and the notion that
a member can have only one domain trust but DCs may have many
inter-domain trusts.)

ADS *can* provide a real global namespace, but the trust stuff still
goes on under the lid.

> Windows doesn't cache the password, not really.  Rather, it caches a
> security token, acquired from some authentication source (local or
> PDC), which it passes as necessary.  This obviates the need for each
> NT box to do authentication or even have accounts; your account at
> the PDC is good enough for all members.  But you knew that already.

It's remarkably like Kerberos, except that they aren't interoperable.
I sometimes think that MS looked at some Athena whitepapers and then
sat down to design something that "works like that", but firmly
embedded in the LanMan worldview and able to provide the desired
degree of customer lock-in.  When the lock-in began looking like
lock-out, it mustn't have been too hard to move over to Kerberos.

-- 
Mark H. Wood, Lead System Programmer   mwood AT IUPUI.Edu
Make a good day.