Authentication Manager - version 1.0.8 - May 11, 1994
by Robert John Churchill - rjc@umich.edu
Compiler: Symantec C version 7.0
Comments? Send mail to: authman-comments@ccs.itd.umich.edu
Problems? Send mail to: authman-problems@ccs.itd.umich.edu
To join the comments list? Send mail to: authman-comments-request@ccs.itd.umich.edu
To join the problems list? Send mail to: authman-problems-request@ccs.itd.umich.edu
NOTE: No warranty/guarantee is expressed or implied. Your mileage may vary. I'm providing this release so that those individuals with an interest in using Kerberos on the Mac will have a sampling of what is being done with Kerberos on the Mac here at the University of Michigan.
Export of this software from the United States of America is assumed to require a specific license from the United States Government. It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.
PLEASE read this entire document. There are many specifics regarding getting Kerberos to work on the Macintosh.
Upgrading from an older version of AuthMan?
___________________________________
Remove the old version of AuthMan from your System Folder. Restart your Mac. Install the new version of AuthMan. Open AuthMan's control panel and configure with necessary information.
Current status of AuthMan at the University of Michigan - May '94
4) inSite (Oracle client app for hardware/software/networking/problem tracking) uses AuthMan
5) Maelstrom (imap mail client) has been modified to use AuthMan (contact wes@umich.edu)
6) MacZephyr implementation by CMU (contact cc4b+@andrew.cmu.edu)
7) NCSA Telnet 2.6 work done by CMU to support authentication and stream encryption via AuthMan (contact jd5v+@andrew.cmu.edu)
8) Eudora mods by CMU (contact ???)
9) Mandarin mods by UM (contact kurtr@umich.edu)
10) Mosaic mods currently being looked at by UM FCE IAA Team (contact billdo@umich.edu)
Configuring Authentication Manager
____________________________
Open AuthMan and add Kerberos realms and associated hosts. For example, the "UMICH.EDU" realm at the University of Michigan has three hosts: "fear.ifs.umich.edu", "surprise.ifs.umich.edu", and "ruthless.ifs.umich.edu".
Optionally, you may append a port number after the host name. For example, "fear.ifs.umich.edu 750". Originally, Kerberos used port 750. Newer implementations may use port 88. If unsure, a good guess is 750.
AuthMan supports both MIT Kerberos and Transarc AFS in terms of different StringToKey routines. AuthMan will now attempt both StringToKey methods unless "AFS" or "MIT" is appended to a realm name. For example, "UMICH.EDU AFS" indicates that the "UMICH.EDU" realm is AFS; only the appropriate AFS StringToKey would be used.
After adding all the realms and hosts, select the "local Kerberos realm" in the realm list and click the "Set Default Realm" button.
Click the Settings button to configure various settings regarding AuthMan.
AuthMan can be used to set the Mac's time, date, (potentially) time zone and daylight savings info. AuthMan supports BOOTP, TIME, and NTP. AuthMan only attempts to set the Mac's clock and associated info ONCE (at startup time). Various shareware NTP implementations exist for the Mac which run constantly. I recommend using one if you are able to; make sure whatever you use is "new" enough to support System 7 Pro's daylight savings bit.
If you are going to use BOOTP to set the Mac's date/time/time zone/daylight savings value, refer to the "BOOTP" section below. If you are going to be using NTP or TIME, refer to the "NTP/TIME" section below. It is worthwhile to read the "Setting Mac Info (general)" section no matter what method you are using to set the Mac's clock.
BOOTP section: (RFCs 1084 and 951).
____________________________________________
What is BOOTP:
BOOTP maps ethernet addresses to IP addresses as well as optionally provides information regarding various other IP services. It is "slightly" extensible; it has a 64 byte parameter area that can hold additional information.
The Mac's date and time have to be correct (within a five minute window of the time on the Kerberos servers). To convert to/from Unix time, the Mac's time zone and daylight savings setting are used.
BOOTP's "to", "ts" and T131 flags (T131 is an extended flag) are used to obtain this information at startup time (if the necessary BOOTP options are selected in AuthMan's control panel):
ts: IP address of a Unix machine running TIMED (most do)
to: set to "auto" (specifies # of seconds from GMT)
T128: "Macintosh Chooser Name"
T129: "Site name" (rather UM-specific)
T130: "Station number" (in hex) (rather UM-specific)
T131: "Daylight Savings Time Flag" (non-zero means dst in effect)
NTP section: (NTP RFCs 1361 and 1305; TIME RFC 868).
____________________________________________
What are NTP and TIME:
Both are time protocols. The TIME protocol returns Unix time. NTP (Network Time Protocol) is a much more versatile protocol than TIME. AuthMan implements NTP as described in the "Simple Network Time Protocol (SNTP)" RFC - basically, reducing the NTP time accuracy to that provided by the TIME protocol.
If you are using NTP or TIME, enter a list of servers the Mac should query. Note that NTP and TIME do not provide information regarding daylight savings. If the time appears to be set an hour off when using NTP or TIME, most likely your Mac has the wrong daylight savings setting - use System 7 Pro's "Date & Time" control panel to set it appropriately.
Setting Mac Info (general)
_______________________
The Mac's date and time have to be correct... there are many services to set this information.
Beginning with System 7 Pro, the "Date & Time" control panel has an option to turn on/off daylight savings. This setting, along with the "Time Zone" setting, must be set correctly. Make sure the Mac's date and time are correct.
If you are using an earlier version of the Mac OS, you will most likely not have a way to modify the daylight savings info (a bit setting stored in PRAM). You will need to use the "Map" control panel with a daylight savings offset calculated into the GMT offset. You will have to modify the value if/when you enter/leave daylight savings. For example, Michigan is -5 hours from GMT when not in daylight savings. However, when in daylight savings, the GMT offset would be "modified" to be -4 for Michigan instead. After entering in the correct GMT offset, set your Mac's date and time (use the "General Controls" control panel, the "Alarm Clock" DA, etc...)
Remember, if you are using System 7 Pro, use the "Date & Time" control panel instead of the "Map" control panel.
