Skip to content

implement dogeADAUth library into Network Share Mounter

Kerberos ticket handling in Network Share Mounter

What if Network Share Mounter could renew kerberos tickets by itself instead of using an external app like NoMAD? This could be dis/enableable by profile for Macs bound to Active Directory.
With the dogeADAuth (a fork of NoMAD-Auth) Framework we have created the necessary tools doing the complicated part

UI/UX

a few thoughts:

  • change color of menu icon if one of the configures shares got an authentication error (or username/password is not configured yet)
  • show a new section with the Kerberos realm:
    • hide if kerberos ticket handling is disabled by profile
    • show realm name if configured by profile
    • show enter username/password button if they have not been set yet
    • show change username/password button if they are set
    • Is there a use case where you want to log out of the ticket server or delete the ticket? If yes, show a button
    • show a status icon:
      • red if no credentials have been saved
      • grey if no ticket server is reachable (Mac is not in enterprise network)
      • red if there are valid kerberos tickets
  • make pre-configured shares editable (not the share itself) if authentication is set to username/password

Something I still have to think about:

  • is multi-realm needed?
  • how onboard new user, how the transition to NSM version 3 for existing user?
    • show initial wizard if there are some shares without credentials
    • show initial wizard for missing kerberos credentials and ticket-renewing is enabled
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information