| TOC |
|
Defines the WebAuth protocol for authenticating users to web applications using only the basic capabilities of a web browser. Authentication is handled by a central login server using a protocol local to the given site. Authentication information is then passed to application servers via encrypted tokens in a URL and maintained by the browser as cookies.
1.
Introduction
1.1.
WebAuth Components
1.1.1.
User-Agent (UA)
1.1.2.
WebAuth-enabled Application
Server (WAS)
1.1.3.
WebKDC
1.2.
WebAuth Tokens
1.3.
Security Model and Key Management
1.3.1.
Distributing and Managing
Session Keys
1.3.2.
Distributing and Managing
Private Keys
1.3.3.
Supporting Server Pools
2.
WebAuth Scenarios
2.1.
No Tokens (Initial Sign-On)
2.2.
App Token
2.3.
No App Token, Proxy Token (Single
Sign-On)
2.4.
No App Token, Credentials Required
2.5.
Logging Out
3.
URL Formats
3.1.
Redirects to the WebKDC
3.2.
Redirects to the WAS
4.
WebKDC XML Protocol
4.1.
XML Protocol Overview
4.2.
Common XML Elements
4.2.1.
<errorCode>
4.2.2.
<errorMessage>
4.3.
XML Commands
4.3.1.
getTokens
4.3.2.
requestToken
4.3.3.
webkdcProxyToken
4.3.4.
webkdcProxyTokenInfo
4.4.
Posting XML to the WebKDC
4.5.
XML Examples
4.5.1.
WAS Asking for webkdc-service Token
4.5.2.
WAS Asking for a credential Token
5.
Token Format
5.1.
Token Encoding
5.2.
Assigned Token Attributes
5.3.
Authentication Factors
5.4.
Specific Token Encoding
5.4.1.
webkdc-service Token
Encoding
5.4.2.
webkdc-proxy Token
Encoding
5.4.3.
request Token Encoding
5.4.4.
error Token Encoding
5.4.5.
id Token Encoding
5.4.6.
proxy Token Encoding
5.4.7.
credential Token Encoding
5.4.8.
login Token Encoding
5.4.9.
app Token Encoding
5.5.
Kerberos Credential Encoding
6.
Cookie Formats
Appendix A.
Document Revision History
§
Authors' Addresses
| TOC |
| TOC |
The WebAuth protocol involves interactions between three basic components:
The WebAuth protocol allows a WAS to securely identify a user accessing resources. It also supports single sign-on, allowing a user to access multiple WebAuth-protected applications without having to authenticate to each one separately (unless an application requires this for security reasons).
The WAS can also choose to either trust the WebKDC to vouch for the identity of a user, or it can request the WebKDC use an authenticator such as a Kerberos service request (KRB_AP_REQ) that it can verify using its own Kerberos keys.
| TOC |
The User-Agent is a web browser that supports cookies. No plugins, Java, or JavaScript are required. The UA will be redirected to the WebKDC as requested to by a WAS.
| TOC |
A WebAuth-enabled Application Server is a web server configured to use WebAuth to authenticate users. If a user hasn't been authenticated yet (indicated by the UA possessing and presenting a WAS cookie), they will be redirected to the WebKDC. Otherwise, the WebAuth-established authenticated identity will be used for access control.
All interactions between the UA and WAS SHOULD be protected with TLS or SSL to prevent cookies being disclosed to an eavesdropper that could use those cookies to impersonate a user. The secure flag SHOULD be set on all WAS cookies to request that the browser enforce this.
| TOC |
The WebKDC will listen for two different type of requests, distinguished by different URLs.
The first type of request are those requests coming from a UA after it has been redirected by a WAS. This component of the WebKDC is referred to as the WebLogin service. When the WebKDC receives one of these, it will first see if the request includes a cookie that contains cached credentials. If the request contains a valid cookie, this cookie is used to obtain a new credentials and the user is redirected back to the WAS (unless the WAS has requested the user reauthenticate). This is the way that WebAuth implements single sign-on.
If the cookie is not present or has expired, then the user will be prompted for their username and password. After submitting this information back to the WebKDC, the WebKDC will then verify the username and password, using whatever protocol is suitable for that site (Kerberos is the default). The WebKDC will the generate two "tokens". One is placed in a cookie scoped for the WebKDC and used to provide single sign-on in future requests, and one that gets sent back to the WAS, which will verify it upon receipt.
The second type of the WebKDC handles consist of XML messages that get POSTed to the WebKDC via HTTPS directly from a WAS. These message are used to establish keys for the WAS servers or to request additional credentials for a user.
The WebKDC is also responsible for ensuring that the server making a request is authorized to make the request. For example, one WAS server can't use a "token" that was created for use by another WAS server.
All interactions between the UA or WAS and the WebKDC MUST be protected via TLS or SSL to prevent disclosure of passwords, as well as sensitive data such as the tokens which are used to provide single sign-on and access to application resources.
| TOC |
Tokens provide a standard mechanism to exchange and store information that is cryptographically secure from both tampering and disclosure. Tokens also contain information such as creation times to help detect replays, and expiration times so data is never trusted/used forever. Tokens also enable authentication of the servers using them.
Tokens get transfered between servers using URL query parameters, POST data, cookies, and XML documents. They are AES-encrypted using either a private key, or a shared session key. They also include a SHA1 HMAC used to detect data modification or tampering.
There are currently nine different types of tokens:
- webkdc-service (encrypted with WebKDC private key)
- The webkdc-service-token is used by WebAuth App Servers to communicate with the WebKDC. It contains a session key that is shared between the WebKDC and the WAS.
webkdc-service tokens are created only by the WebKDC, and are used only by a WAS. From the perspective of the WAS, they are opaque blobs that are sent back to the WebKDC- webkdc-proxy (encrypted with WebKDC private key)
- The webkdc-proxy-token contains a user's proxied credentials (generally, but not necessarily, a Kerberos ticket-granting ticket). It can only be decrypted by the WebKDC, and the WebKDC will only allow a webkdc-proxy token to be used by the server it was originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie scoped to the WebLogin service. Its-proxy-token cos originally generated for. The main use of a webkdc-proxy token is by the WebKDC itself to implement single sign-on; that webkdc-proxy token is usually put in a cookie