Kerberos or passthru authentication with Active Directory?

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

brazen

Kerberos and passthru authentication seem to fill the same niche in regards to authenticating to Active Directory.  They both support SSO, both support CIFS, and neither support syncing user details.  But kerberos is more secure and supports newer protocols, so it's seems to me kerberos would be the better choice between kerberos or passthru.  Is this correct?

I only wonder because all the documentation I find (through Google) for using Alfresco with Active Directory talks about passthru instead of kerberos.  I haven't been using Alfresco for long, so I didn't know if maybe kerberos was just very new and all that documentation is outdated, or if maybe I was missing some reason for why passthru would be used instead of kerberos.

For example, this wiki page http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Example_1:_Advanced_AD_Chain
suggest using the following auth chain:

alfrescoNtlm1:alfrescoNtlm,passthru1assthru,ldap1:ldap-ad

but it seems to me something like this would be better:

alfrescoNtlm1:alfrescoNtlm,kerberos1:kerberos,ldap1:ldap-ad

wabson

Brazen,

Both NTLM/passthru and Kerberos have been supported for a long time in Alfresco, so they should both have good levels of support.

Technically, most people would probably consider Kerberos the superior protocol, but the fact that it is also more complex makes it more difficult to set up.

For this reason we find that most people today go for the easier option which is NTLM, but if you have the skills to get Kerberos up and running you will have a more secure system.

I'm intrigued however why you would want to chain NTLM and Kerberos together, given that they'd likely be hitting the same directory server. Plus as the wiki notes, there are restrictions around challenge-response mechanisms like these that mean in practice you can only really use one at a time.

Hope that helps.

Will.