基于Kerberos的统一认证授权研究Centralized

应用广泛的Kerberos 协议缺乏支持集中式授权的机制，无法解决集团型企业跨域访
问控制问题。本文提出一种基于Kerberos 的统一认证授权方案KCAA，通过Kerberos 与授权中心的无缝集成，有效实现总部对跨域访问的集中式认证授权。KCAA 采用抽象用户减少各域内信息同步量，并采用身份代理简化Kerberos 的部署。在大规模集团型企业信息化建设中的应用表明，KCAA 无需对现有系统进行大规模改造，即可实现集中式跨域访问控制，具有良好应用价值。
关键字：Kerberos; 集团型企业; 访问控制; 认证授权

Abstract: Because of lacking support for centralized authorization, widely-applied Kerberos
couldn’t realize cross-domain access control in group enterprises. Therefore, a Kerberos-based Centralized Authentication Authorization (KCAA) scheme is proposed. By integrating centralized authorization into Kerberos, KCAA achieves centralized authentication and authorization in headquarter for cross-domain access. KCAA uses abstract users to reduce information synchronization in different domains, and identity agents to simplify deployment of Kerberos. KCAA shows its application value in the informatization construction of a large group enterprise which proves that it could achieve centralized cross-domain access control without mass transformation of legacy systems.
Key words: Kerberos; group enterprises; access control; authentication and authorization