Subject: RE: On Kerberos principal name canonicalization

From: Matt Hur <[email-masked]>
Date: Wed, 13 Sep 2000 18:13:49 -0700

> -----Original Message-----
> From: Ken Raeburn [mailto:[email-masked]]
> Sent: Wednesday, September 13, 2000 4:23 PM
> To: Matt Hur
> Cc: 'Nicolas Williams'; Cliff Neuman-ISI; [email-masked];
> [email-masked]
> Subject: Re: On Kerberos principal name canonicalization
> 
> 
> 
> Matt Hur <[email-masked]> writes:
> > This is not the canonicalization that is specified in the 
> revisions.  The
> > Kerberos name canonicalization allows a client to indicate 
> to the KDC that
> > it is ok to return a ticket (or referral) for a server name 
> that does not
> > match the server name in the request (i.e. an alias).
> > 
> > What you are describing seems to be out of scope of the 
> Kerberos revisions.
> 
> Look at the first paragraph of section 3.1.3 as mailed out.  It talks
> about looking up the principal name in an alternate database (which I
> think is too implementation-oriented a description).
> 
> I also note in passing that the AS_REP generation description doesn't
> seem to allow for canonicalization of the specified server principal,
> in case it's not a krbtgt principal.  And there's no discussion about
> whether krbtgt principal names can be the canonical forms of other
> service principal names (say if some site makes Kerberos admin service
> use the krbtgt principal), and the possibility of ambiguity that might
> result in interpreting the response.
> 

These are good comments wrt name canonicalization.  I don't see how this
relates to my comment about user promotion in Windows 2000 (not name
canonicalization) being out of scope.  Am I missing something?

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 13 Sep 2000 22:10:08 -0400

> canonicalization) being out of scope.  Am I missing something?

I think I confused referrals with name canonicalization.

Sorry,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 13 Sep 2000 22:10:08 -0400

Sorry,

Nico
--