Subject: RE: Section 7 Kerberos Revisions for comment

From: "Moore, Patrick" <[email-masked]>
Date: Tue, 26 Sep 2000 18:08:07 -0600

Nico,

I could live with what you've proposed here, but personally still prefer my
simpler solution, which is adequate for anything I can envision with DCE and
W2K. My solution gets us from the current situation where we flat cannot use
DCE (or W2K) containers to manage SASL service principals to a situation
where we can, which is really all we need. Your suggestion goes further to
allow things that I don't anticipate needing, at a cost in simplicity. 

Where your examples say "service" I would recommend "component1".  Typically
the leading component would be a container name, and the second component
might be something out of /etc/services. 

- pat

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Tuesday, September 26, 2000 3:35 PM
> To: Moore, Patrick
> Cc: [email-masked]'
> Subject: Re: Section 7 Kerberos Revisions for comment
> 
> 
> 
> Well, that may be the solution: that the SPN NT_SRV_HST form 
> depends on
> the context. After all, the clients and services referencing or using
> these SPNs should know the context in which they're used.
> 
> So then the NT_SRV_HST rules might be:
> 
>  - SPNs with 2 components must be of the form <service> / <host>
> 
>  - The form of SPNs with more than 2 components may vary according to
>    the application. Specifically there can be two forms:
> 
>     - <service> / <host> / <component3> [ / ... / <componentN>]
> 
>     - <service> / <component2> [ / ... / <componentN> ] / <host>
> 
> Can we ban '.' from non-hostname SPN components (instances)? That, at
> least, would allow a heuristic for determining the SPN form 
> when context
> is missing and FQDNs are used.
> 
> Any other strange SPN forms?
> 
> Nico
> 
> 
> On Tue, Sep 26, 2000 at 03:15:14PM -0600, Moore, Patrick wrote:
> > DCE also uses components that trail the hostname for many 
> (maybe most) of
> > its RPC principals. We have lots and lots of them in the form
> > "hosts/<hostname>/self" (and <hostname> is not canonical, 
> contains no dot.)
> > W2K princ names are similar (Windows RPC is an adaptation 
> of DCE RPC).  It
> > never worried me that these can't be used for NT_SRV_HST 
> style services -
> > they were never intended for that. 
> > 
> > Again, I'm trying to solve a real-world problem for DCE 
> infrastructures in a
> > way that does not break things and can be cleanly implemented and
> > documented. If a solution involving parsing of dots or 
> embedding slashes
> > better supports some W2K or X.500 installation, then I 
> could live with that.
> > 
> > 
> > 
> > - pat
> > 
> --
>

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 27 Sep 2000 11:47:15 -0400

Ok. The only issue is: is anyone using NT_SRV_HST SPNs with more than 2
components where the hostname is the second component. If so then what
you propose is not backwards compatible.

One may wish to take my proposal further and state that the first
component of SPNs with more that 2 components provides the context
needed to distinguish if the hostname is the second or last component.
But given what you say below, I doubt it would be safe to do so.

Nico

--