> > Authentication must be the responsibility of the script writer. While
Interesting. I just returned from a meeting where various security
experts impressed on me just how bad an idea that is, as it increases
the amount of code in the "Trusted Computing Base" unmanageably. They
felt that such a system could never be rated secure.
> What he said. Any authentication mechanism must allow for any
> authentication data to be passed to the server. I want to write HTML
> front ends to various Kerberos authenticated doobreys, and I MUST be
> able to pass a ticket to the server, and preferably also encrypted data
> using the Kerberos session key.
Well, perhaps as an option.
Bill