The reverse capability of generating a Globus Proxy Certificate from a Kerberos v5 TGT is provided by the Globus K5cert software. This functionality can provide SSO for both a Kerberos v5 and Globus environment, provided the CA of the proxy certificate is trusted by other Globus sites. On the topic of interoperability between W2000 and MIT Kerberos, it should be possible for W2000 clients to authenticate to MIT Kerberos, acquire a TGT and then a service ticket for Active Directory which gives the SID authorization data, necessary for W2000. An X.509 certificate repository is planned to overcome the problem of travelling users who may not have their certificates locally available, for example at conferences, cybercafes, or other remote sites. Code for this, called myproxy, is nearing completion.
Clients can submit proxy certifiates to the repository for a pre-specified time period.
The myproxy code is being developed by the portal group of the Globus team. In addition, the idea of restricted delegation is being developed. It is expected that people will have many certificates to be used for different tasks or at different sites. Depending on the activity, a user can delegate the use of an appropriate certificate to a server. This combines nicely with certificate repositories, where you may only want a restricted set of capabilities, for example, e-mail, to be available during your travels, leaving your other certificates safely at home.