Subject: Re: SPNEGO SOMIC rules

From: Luke Howard <[email-masked]>
Date: Wed, 17 Nov 2004 10:39:30 +1100

>This requirement is implicit from the GSS-API architecture that
>allowed for multi-mechanisms even before SPNEGO was invented.
>The server/acceptor MUST always look at the mechanism OID of the
>initial context token and dispatch the token accordingly

Agreed, but there is an argument that protocols that do their own
security mechanism negotiation such as SASL and RPC may wish to
restrict the list of GSS mechanisms they are willing to accept.

-- Luke

--

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Martin Rex <[email-masked]>
Date: Wed, 17 Nov 2004 13:53:05 +0100 (MET)

> restrict the list of GSS mechanisms they are willing to accept.

SPNEGO is not a real mechanism, but a pseudo- or wrapping mechanism
that only provide negotiation and leaves the actual work to one of
the underlying real gssapi mechanisms.

Therefore I would expect any mechanism like you mention (SASL,RPC)
that does negotiation on its own to reject SPNEGO, if any, because
SPNEGO is not a mechanism itself and hides the actual mechanism
token inside a non-trivial SPNEGO-token, and not necessarily in the
first one.

-Martin