Subject: RE: SPNEGO SOMIC rules

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Wed, 17 Nov 2004 18:45:26 -0800

Wyllys Ingersoll wrote:
> Perhaps there should be some sort of statement in the new SPNEGO draft
that clearly states that initiators who only send 1 
> mech in the mechlist should not use SPNEGO at all and just use their
preferred mechanism.  Likewise, servers that accept > > SPNEGO should
also be able to accept initial tokens for any of their supported
mechanisms without SPNEGO wrapping.

No, this might solve the case with a SUN client and MS server, but not
the case with a MS client and a SUN server. Our clients do have more
than one to offer.

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Wyllys Ingersoll
Sent: Tuesday, November 16, 2004 1:28 PM
To: Sam Hartman
Cc: [email-masked]
Subject: Re: SPNEGO SOMIC rules

Sam Hartman wrote:
>>>>>>"Martin" == Martin Rex <[email-masked]> writes:
> 
> 
> 
>     Martin> I think that a client that has only a single mechanism an
>     Martin> uses SPNEGO is broken, it should be using the underlying
>     Martin> gss-api mechanism directly, and will become interoperable
>     Martin> with peers that do not support SPNEGO.
> 
>     Martin> Actually, the client's SPNEGO implementation could make
>     Martin> that optimization instead of going for the SPNEGO exchange
>     Martin> with optimistic token.  That way it will not only
>     Martin> omit/save the mechListMIC, but all the SPNEGO overhead and
>     Martin> complexity.
> 
> we need to mandate that a server receieving a normal mechanism token 
> but expecting an SPNEGO token should respond appropriately if we're 
> going to allow this optimization.  I don't mind mandating that, but I 
> don't think we do today.

Perhaps there should be some sort of statement in the new SPNEGO draft
that clearly states that initiators who only send 1 mech in the mechlist
should not use SPNEGO at all and just use their preferred mechanism.
Likewise, servers that accept SPNEGO should also be able to accept
initial tokens for any of their supported mechanisms without SPNEGO
wrapping.

-Wyllys

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Wyllys Ingersoll <[email-masked]>
Date: Thu, 18 Nov 2004 07:30:20 -0500

> the case with a MS client and a SUN server. Our clients do have more

In the case of the Solaris GSS server, it would accept GSS-SPNEGO or GSS-KRB5,
either one would work.  The point I was making is that GSS servers should
not restrict themselves to accept *only* SPNEGO, so that if a client only
supports a single mechanism, the server would still be able to process it.

-Wyllys