Subject: RE: Section 7 Kerberos Revisions for comment

From: "Moore, Patrick" <[email-masked]>
Date: Mon, 25 Sep 2000 16:21:39 -0600

Re:
Ken> Would you suggest also extending NT-SRV-XHST in the same manner, so as
Ken> to allow the slash-separated components in the service name regardless
Ken> of the hostname format? 

My suggestion is that the NT_SRV_XHST wording stay unchanged, so that the
first component is the service and evrything else is the host. NT_SRV_HST
would be just the opposite - the last component is the host and everything
else is the service. In both cases you know where the boundry is.

I'm also unfamiliar with X.500 hostname formats, and don't know whether
anybody might want to somehow use that format in a GSSAPI/SASL
service@hostname connection. But I know that if the NT_SRV_XHST were to be
extended to allow slash separated service names you would have a problem --
you would have no way of knowing the boundry between the service and the
host. And for this gssapi nametype you must be able to parse out the
hostname part from the service name part. (When krb5 gss imports a
gss_nt_service_name it validates the hostname part of the principal using
gethostbyname/gethostbyaddr calls.)

- Pat  

> -----Original Message-----
> From: Ken Raeburn [mailto:[email-masked]]
> Sent: Monday, September 25, 2000 3:06 PM
> To: [email-masked]
> Subject: Re: Section 7 Kerberos Revisions for comment
> 
> 
> "Moore, Patrick" <[email-masked]> writes:
> > I believe Kerberos should support the service@hostname functionality
> > provided by SRV_HST name types, but where the service name 
> consists of slash
> > separated components, and the hostname is the single 
> (final) component.  
> 
> Would you suggest also extending NT-SRV-XHST in the same manner, so as
> to allow the slash-separated components in the service name regardless
> of the hostname format?  I'm not very familiar with X.500 hostname
> formats.  Can ambiguities arise this way?  Do we care about being able
> to easily identify the boundary between service name and hostname?
> 
> Ken
>

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 25 Sep 2000 22:16:56 -0400

Pardon me, but, if the hostname is not X.500 then it must be an FQDN, as
in a DNS FQDN. Right? Then, if you never use '.' in service names, you
can distinguish the hostname components in NT-SRV-XHST from the other
instance components. Granted, it's hackish.

Does anyone use '.' in service name components other than hostnames?

Nico

--

---

From: Ken Raeburn <[email-masked]>
Date: 25 Sep 2000 23:54:18 -0400

> else is the service. In both cases you know where the boundry is.

So would the first component be "foo/bar" (with "foo\/bar/host/name"
in the printed form)?  If so, that'd work for NT_SRV_HST as well.  Or
do you just not get the ability to provide multipart service
identification with X.500 names?

> service@hostname connection. But I know that if the NT_SRV_XHST were to be

I would guess so, if anyone's using Kerberos and X.500 names in the
same environment.  Having to pass different service names depending on
the hostname type would be unfortunate.

> instance components. Granted, it's hackish.

What about using '.' for service name components in both name types?
Then the service name supplied and the work done to pick it apart are
identical regardless of the hostname type.

> Does anyone use '.' in service name components other than hostnames?

Realm, AFS cell, or other domain-like entity names ... but not as
anything other than the domain-like-entity name in anything I've seen.

Ken