Kerberos is an absolute mystery to me, but it might be a useful addition for others. I'm not against it, but I'll warn that you may have a rough road in review of your pull request as I'll probably be loaded with questions and, given how little I know, I would probably be looking for a good bundle of documentation to come with it. I'd also be looking for tests so it's good that you mention a "testing framework". I don't know what directory-kerby does so I can't say if it's acceptable or if there are better options. It's nice that it is Apache-based though as we would obviously need to be sure that any dependencies kerberos brings would meet Apache licensing requirements. I think that additional config files make sense and would definitely be a good complement to the documentation. As for logging, I guess I'd need to see what you wanted to change exactly. I'm not fully following what you mean in item 4.
If anyone else knows kerberos well and can help guide in a pull request like this, please let it be known. I'll probably not be a big help on this. On Sat, Nov 19, 2016 at 8:10 AM, Marc de Lignie <[email protected]> wrote: > Hi all, > > I am working on a Kerberos Authenticator for the existing sasl plugin > mechanism for gremlin-server. I would be happy to contribute it as a PR to > TinkerPop, but would like some feedback before making the effort to do so. > > So these are my questions: > > 1. Would TinkerPop welcome a Kerberos plugin as part of the > gremlin-server distribution, provided it meets quality standards? > > > 2. Is the Apache directory-kerby project an acceptable testing framework, > given that it only has RC status: https://github.com/apache/dire > ctory-kerby/tree/kerby-all-1.0.0-RC2 (it is provided from maven, though). > I have experienced it as very pleasant to use. I will use the plugin > myself in an freeIPA Kerberos environment, but will not provide tests for > that. > > > 3. Would additional config files for gremlin-console and gremlin-server > be acceptable (more helpful than mere documentation, but both already have > a considerable number of config files to choose from)? > > > 4. Would slight changes to the gremlin-server logging be acceptable (to > enable audit logging items with both the authorized user and the issued > gremlin query)? > > > Cheers, Marc de Lignie > > >
