應用廣泛的Kerberos 協議缺乏支持集中式授權的機制，無法解決集團型企業跨域訪
問控制問題。本文提出一種基于Kerberos 的統一認證授權方案KCAA，通過Kerberos 與授權中心的無縫集成，有效實現總部對跨域訪問的集中式認證授權。KCAA 采用抽象用戶減少各域內信息同步量，并采用身份代理簡化Kerberos 的部署。在大規模集團型企業信息化建設中的應用表明，KCAA 無需對現有系統進行大規模改造，即可實現集中式跨域訪問控制，具有良好應用價值。
關鍵字：Kerberos; 集團型企業; 訪問控制; 認證授權

Abstract: Because of lacking support for centralized authorization, widely-applied Kerberos
couldn’t realize cross-domain access control in group enterprises. Therefore, a Kerberos-based Centralized Authentication Authorization (KCAA) scheme is proposed. By integrating centralized authorization into Kerberos, KCAA achieves centralized authentication and authorization in headquarter for cross-domain access. KCAA uses abstract users to reduce information synchronization in different domains, and identity agents to simplify deployment of Kerberos. KCAA shows its application value in the informatization construction of a large group enterprise which proves that it could achieve centralized cross-domain access control without mass transformation of legacy systems.
Key words: Kerberos; group enterprises; access control; authentication and authorization