Can I use Kerberos for Macintosh behind a NAT (Network Address Translation)?
In some cases, yes. Kerberos 4 does not support addressless tickets, so no Kerberos 4 or KClient-using application can be made to work behind a NAT. However, Kerberos 5 can be told to use addressless tickets, which will allow Kerberos 5-using applications to work behind a NAT. However, applications that use the GSSAPI and require channel bindings, such as FTP, will still not work.
In some cases, yes. Kerberos 4 does not support addressless tickets, so no Kerberos 4 or KClient-using application can be made to work behind a NAT. However, Kerberos 5 can be told to use addressless tickets, which will allow Kerberos 5-using applications to work behind a NAT. However, applications that use the GSSAPI and require channel bindings, such as FTP, may still not work. Mac OS X 10.3 and 10.4 get addressless tickets by default, although you can change this setting by setting the “Get tickets without IP addresses” checkbox in the Authenticate to Kerberos dialog (click on the “Show Options” button or choose “Options…” from the pulldown menu to see this checkbox).
