Subject: I-D ACTION:draft-ietf-cat-kerberos-revisions-06.txt

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 24 Jul 2000 08:20:02 -0500

This draft will be the main topic of the krb-wg meeting 8/2 at 1530
Please read this in preperation for the meeting. If all goes well
it should endup as the last call version sometime in August.

Doug

------------------------------------------------------------------------------ 

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Kerberos WG Working Group of the IETF.

        Title           : The Kerberos Network Authentication Service (V5)
        Author(s)       : C. Neuman, G. Kohl, T. Ts'o
        Filename        : draft-ietf-cat-kerberos-revisions-06.txt
        Pages           : 103
        Date            : 21-Jul-00
        
This document provides an overview and specification of Version 5 of the
Kerberos protocol, and updates RFC1510 to clarify aspects of the protocol and its intended use that
require more detailed or clearer explanation than was provided in RFC1510. This document is intended
to provide a detailed description of the protocol, suitable for implementation, together with
descriptions of the appropriate use of protocol messages and fields within those messages.

This document is not intended to describe Kerberos to the end user, system
administrator, or application developer. Higher level papers describing
Version 5 of the Kerberos system [NT94] and documenting version 4 [SNS88],
are available elsewhere.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-revisions-06.txt

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
        "get draft-ietf-cat-kerberos-revisions-06.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: "Moore, Patrick" <[email-masked]>
Date: Tue, 1 Aug 2000 12:57:01 -0600

Comments on
www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-revisions-06.txt 

1.  Section 7.2, Principal Names:

The new draft adds a new type, NT-SRV-XHST       4   Service with
slash-separated host name components.

I would like to suggest an additional type that would support compound
service names (and single hostname component.) 

We have this kludged into the code at Sandia in order to support GSSAPI
based services that are managed using DCE container ACLs. A typical
principal name at Sandia (or at other DCE sites) would be
drm/broker/[email-masked]

The service for this is a three component principal name, with the first two
components being the service and the last component always being the host.

A new type might help support this in the standard. perhaps:
NT-XSRV-HST 8  /*Slash separated service components with single host name
component */

2.  User to User authentication

I see that this draft includes new error messages that will support user 2
user authentication.  I don't see new Kerberos message types for sending a
request for a TGT, or for sending the TGT itself.  New message types were
suggested in old (now expired) internet drafts for supporting user-to-user
in GSSAPI over Kerberos.  Can I assume that new message types for the TGT
Request and TGT reply were deemed unnecessary?

(Note - I've got running code that adds user-to-user to GSSAPI over
Kerberos. In my code I've defined a couple new GSSAPI tokens, but not new
Kerberos messages.  (The TGT request body contains general strings for the
principal name and realm name, and the TGT reply is just the second ticket,
sent as an octet stream.)  

- Pat Moore
Sandia Labs
[email-masked]
505-844-3588

-----Original Message-----
From: Douglas E. Engert
To: [email-masked]
Sent: 7/24/00 7:20 AM
Subject: I-D ACTION:draft-ietf-cat-kerberos-revisions-06.txt

Doug

------------------------------------------------------------------------
------ 

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Kerberos WG Working Group of the IETF.

        Title           : The Kerberos Network Authentication Service
(V5)
        Author(s)       : C. Neuman, G. Kohl, T. Ts'o
        Filename        : draft-ietf-cat-kerberos-revisions-06.txt
        Pages           : 103
        Date            : 21-Jul-00
        
This document provides an overview and specification of Version 5 of the
Kerberos protocol, and updates RFC1510 to clarify aspects of the
protocol and its intended use that
require more detailed or clearer explanation than was provided in
RFC1510. This document is intended
to provide a detailed description of the protocol, suitable for
implementation, together with
descriptions of the appropriate use of protocol messages and fields
within those messages.

This document is not intended to describe Kerberos to the end user,
system
administrator, or application developer. Higher level papers describing
Version 5 of the Kerberos system [NT94] and documenting version 4
[SNS88],
are available elsewhere.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-revisions-06
.txt

Internet-Drafts are also available by anonymous FTP. Login with the
username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
        "get draft-ietf-cat-kerberos-revisions-06.txt".

--