{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/13697","labels_url":"https://api.github.com/repos/docker/docker/issues/13697/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/13697/comments","events_url":"https://api.github.com/repos/docker/docker/issues/13697/events","html_url":"https://github.com/docker/docker/issues/13697","id":84531039,"number":13697,"title":"Adding Kerberos support to Docker","user":{"login":"dimastopel","id":675265,"avatar_url":"https://avatars.githubusercontent.com/u/675265?v=3","gravatar_id":"","url":"https://api.github.com/users/dimastopel","html_url":"https://github.com/dimastopel","followers_url":"https://api.github.com/users/dimastopel/followers","following_url":"https://api.github.com/users/dimastopel/following{/other_user}","gists_url":"https://api.github.com/users/dimastopel/gists{/gist_id}","starred_url":"https://api.github.com/users/dimastopel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dimastopel/subscriptions","organizations_url":"https://api.github.com/users/dimastopel/orgs","repos_url":"https://api.github.com/users/dimastopel/repos","events_url":"https://api.github.com/users/dimastopel/events{/privacy}","received_events_url":"https://api.github.com/users/dimastopel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/kind/proposal","name":"kind/proposal","color":"bfe5bf"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-03T12:20:44Z","updated_at":"2015-06-03T13:20:47Z","closed_at":null,"body":"Hi Guys\r\n\r\nWe develop a container security suite oriented to the enterprises. As part of it we support Kerberos as an authentication mechanism between Docker CLI and the Docker daemon. We currently have it up and running but, honestly, think it should be part of the platform. Hence, we would like to contribute the code to Docker. \r\n\r\nToday we use Nalin's GSS Go wrapper (<https://github.com/nalind/gss>) over vanilla MIT Kerberos (<https://github.com/krb5/krb5>). \r\n\r\nI'd like to propose the following, simple, addition to the command line interface that enables generating Kerberos ticket (TGS) on the client (CLI), and require validating Kerberos ticket on the daemon.\r\n\r\nCLI example:\r\n\r\n    docker -H docker-host:8080 --kerbverify --kerbspn=<service_name> ps\r\n\r\nDocker daemon example:\r\n\r\n    docker -d --kerbverify --kerbspn=<service_name / *> --kerbkeytab=/tmp/docker_keytab\r\n\r\nThe SPN argument is mandatory. However, keytab argument is not. In case keytab is not specified, a default path is used. The default path is: `/etc/krb5.keytab` (as in [MIT krb5](http://web.mit.edu/KERBEROS/krb5-1.12/doc/mitK5defaults.html))\r\n\r\nAll variables can be configured using environmental variables:\r\n\r\n    DOCKER_KERB_VERIFY\r\n    DOCKER_KERB_SPN\r\n    DOCKER_KERB_KEYTAB\r\n\r\nWe will support MIT krb5 and Microsoft Active Directory as KDC.\r\n\r\nI would be glad to hear you general thoughts and if make sense I'll send a more elaborated technical descriptions of what we'd like to do. \r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/108405922","html_url":"https://github.com/docker/docker/issues/13697#issuecomment-108405922","issue_url":"https://api.github.com/repos/docker/docker/issues/13697","id":108405922,"user":{"login":"dimastopel","id":675265,"avatar_url":"https://avatars.githubusercontent.com/u/675265?v=3","gravatar_id":"","url":"https://api.github.com/users/dimastopel","html_url":"https://github.com/dimastopel","followers_url":"https://api.github.com/users/dimastopel/followers","following_url":"https://api.github.com/users/dimastopel/following{/other_user}","gists_url":"https://api.github.com/users/dimastopel/gists{/gist_id}","starred_url":"https://api.github.com/users/dimastopel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dimastopel/subscriptions","organizations_url":"https://api.github.com/users/dimastopel/orgs","repos_url":"https://api.github.com/users/dimastopel/repos","events_url":"https://api.github.com/users/dimastopel/events{/privacy}","received_events_url":"https://api.github.com/users/dimastopel/received_events","type":"User","site_admin":false},"created_at":"2015-06-03T13:20:47Z","updated_at":"2015-06-03T13:20:47Z","body":"@duglin Yes, HTTP Authorization header"}}