Subject: Re: Single canonical names

From: Martin Rex <[email-masked]>
Date: Thu, 4 Nov 2004 22:20:52 +0100 (MET)

Sam Hartman wrote:
> 
> >>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:
> 
>     Nicolas> Also, for default name, think of the MIT krb5 ccache.  It
>     Nicolas> can store tickets for more than one client principal, but
>     Nicolas> the ccache file format specifies a default principal name
>     Nicolas> so that even if one does store tickets for multiple
>     Nicolas> different client principals it is always clear which to
>     Nicolas> use when not explicitly requesting one or another name.
> 
> Remember the thread on krbdev where we proposed to drop that and use
> the best match principal for the service in question.

Actually that would break the GSS-API abstraction.  A GSS-API credential
may have mechanis-specific names, it may NOT have target-specific names.

-Martin

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Sam Hartman <[email-masked]>
Date: Thu, 04 Nov 2004 17:00:59 -0500

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    >>  Remember the thread on krbdev where we proposed to drop that
    >> and use the best match principal for the service in question.

    Martin> Actually that would break the GSS-API abstraction.  A
    Martin> GSS-API credential may have mechanis-specific names, it
    Martin> may NOT have target-specific names.

Yes.  It's clear that the intent of the spec is consistent with what
you are saying.  

It seems like GSSAPI V2 has the requirement that if I export the name
I get from my default credentials, that needs to be the same as the
name I get by exporting the name from my context established with
those credentials.

Thanks for pointing this out.  I had previously convinced myself that
if I went through enough contortions in how I defined what name types
were used that I could get the behavior I want.

--Sam

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 4 Nov 2004 16:08:19 -0600

> were used that I could get the behavior I want.

I think of GSS name types as much like Kerberos V name types: hints,
except that in the GSS case they can determine the "query" syntax for
that name type.

Nico
--