應(yīng)用廣泛的Kerberos 協(xié)議缺乏支持集中式授權(quán)的機(jī)制，無法解決集團(tuán)型企業(yè)跨域訪
問控制問題。本文提出一種基于Kerberos 的統(tǒng)一認(rèn)證授權(quán)方案KCAA，通過Kerberos 與授權(quán)中心的無縫集成，有效實(shí)現(xiàn)總部對跨域訪問的集中式認(rèn)證授權(quán)。KCAA 采用抽象用戶減少各域內(nèi)信息同步量，并采用身份代理簡化Kerberos 的部署。在大規(guī)模集團(tuán)型企業(yè)信息化建設(shè)中的應(yīng)用表明，KCAA 無需對現(xiàn)有系統(tǒng)進(jìn)行大規(guī)模改造，即可實(shí)現(xiàn)集中式跨域訪問控制，具有良好應(yīng)用價值。
關(guān)鍵字：Kerberos; 集團(tuán)型企業(yè); 訪問控制; 認(rèn)證授權(quán)

Abstract: Because of lacking support for centralized authorization, widely-applied Kerberos
couldn’t realize cross-domain access control in group enterprises. Therefore, a Kerberos-based Centralized Authentication Authorization (KCAA) scheme is proposed. By integrating centralized authorization into Kerberos, KCAA achieves centralized authentication and authorization in headquarter for cross-domain access. KCAA uses abstract users to reduce information synchronization in different domains, and identity agents to simplify deployment of Kerberos. KCAA shows its application value in the informatization construction of a large group enterprise which proves that it could achieve centralized cross-domain access control without mass transformation of legacy systems.
Key words: Kerberos; group enterprises; access control; authentication and authorization