Another walkaround I can think of is to adjust the time zone difference specifically when you do Kerberos authentication. Let's say there is an application called netAuthService that takes care of authentication. Then if you can detect your authentication type is Kerberos, then you tweak your time in your authentication request to within the timezone of your Kerberos server.
Is this feasible? ________________________________ From: Andrea Cirulli [mailto:[email protected]] Sent: Friday, April 17, 2009 4:52 PM To: Xu, Qiang (FXSGSC); [email protected] Subject: Re: kerberos and time zone Obviously it is not possible....I cannot make such a decision, because there are sensible data that needs that time is synch with the country in which are located. So there is no solution? On Fri, Apr 17, 2009 at 10:43 AM, Xu, Qiang (FXSGSC) <[email protected]<mailto:[email protected]>> wrote: Why not let your server sync with American NTP server? > -----Original Message----- > From: [email protected]<mailto:[email protected]> > [mailto:[email protected]<mailto:[email protected]>] On Behalf > Of Andrea Cirulli > Sent: Friday, April 17, 2009 4:37 PM > To: [email protected]<mailto:[email protected]> > Subject: kerberos and time zone > > Hi all, > > I have the following problem: > > We are managing the authentication of several servers with > Kerberos. The issue lies in the fact that the servers are in > different time-zone, so we have problem with clock skew > errors. Are there any solution or workaround that accomplish > this requirement using different ntp in different time zone > in a way that the KDC server knows which is the real clock > skew between two different time zone? > > Let's say i have a server located in Rome and its time is > synch with an italian ntp and we have a server located in New > York with time synch with an American NTP. Considering the > time zone the two times are synch, however for kerberos are desynch. > > Is there any workaround or solution to this issue? > > We are planning to use a bigger clock skew which will cover > the difference between the two time zones ( this is the worst > solution). > > Any hint would be helpful. > > Thanks in advance. > > -- > Andrea Cirulli > ________________________________________________ > Kerberos mailing list [email protected]<mailto:[email protected]> > https://mailman.mit.edu/mailman/listinfo/kerberos > -- Andrea Cirulli ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
