As proof of its interoperability, Shanen Boettcher, lead product manager for Windows 2000 Server, cites customers such as Morgan Stanley Dean Witter that installed Windows 2000 desktops in a network running an existing Kerberos implementation by a company called CyberSafe in Issaquah, Wash. According to Microsoft, the successful installation of its Kerberos implementation alongside CyberSafe's "validates the interoperability of Kerberos in the Windows 2000 operating system."
But this validity depends on the definition of "interoperable." In Microsoft's view, Kerberos interoperability covers only the authentication process (the password system that validates a user's identity), which is defined in the open part of the spec. That interoperability does not, however, extend to the authorization process (the system that decides if a particular user has access to resources on the network), which is the part Microsoft addressed in that carefully guarded undefined field.
Microsoft is treating the authorization process as totally proprietary because authorization to use a Microsoft application requires a Windows 2000 Server. "If you want access rights to applications on Windows, it has to process its own authorization," says Boettcher.
Customers, like Morgan Stanley, that want to access basic functions such as file and print services from Windows 2000 desktops must purchase and run a Microsoft Windows 2000 Kerberos Server, even if they already have another Kerberos implementation in use.
Facebook
Twitter