Subject: RE: Section 7 Kerberos Revisions for comment

From: "Moore, Patrick" <[email-masked]>
Date: Tue, 26 Sep 2000 14:16:58 -0600

Re:
nico> You proposed allowing '/' characters in the 
nico> components, yes? Isn't that a problem? I mean, 
nico> won't you have to quote '/' characters and so on?

My proposal did not involve embedded slashes in component names. Ken
suggested that, and I agreed that I might be able to make that work for us
if necessary.  But I still like my original proposal best: simply that for
NT_SRV_HST we allow more than one component for the server name, and
continue to assume that the final component is the hostname. I know how to
make this work, and see it as the cleanest 'do no harm' modification to
support DCE infrastructures.

- pat

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Tuesday, September 26, 2000 1:56 PM
> To: Moore, Patrick
> Cc: [email-masked]
> Subject: Re: Section 7 Kerberos Revisions for comment
> 
> 
> On Tue, Sep 26, 2000 at 01:34:16PM -0600, Moore, Patrick wrote:
> > Re:
> > nico> At any rate, if you have no dots in components other that the 
> > nico> host name you can at least distinguish the hostname from the 
> > nico> other components.
> > 
> > To distinguish you also need to assume that a hostname 
> component always has
> > a dot. 
> 
> Yes. If no component has a dot you can default things so the second
> component MUST be the hostname.
> 
> Hackish, hackish. I know.
> 
> > If the spec were modified to say that for NT_SRV_HST dots 
> must not be used
> > in non-hostname principal components, and must be present 
> in hostname
> > principal components, then I could kludge in what I need.  
> With that, we
> > would have even more flexibility - could allow names like
> > <container>/<hostname>/<instance>
> 
> Right.
> 
> > But I worry that there are deployments out there where the canonical
> > hostname does not have a dot, and the above change would 
> break things for
> > them.  My proposed change was designed to do no harm to existing
> > deployments. 
> 
> You proposed allowing '/' characters in the components, yes? 
> Isn't that
> a problem? I mean, won't you have to quote '/' characters and so on?
> 
> I think that conventions such as: "a hostname component must 
> have a . or
> else it must be the second component" are simpler to deal with.
> 
> The draft already contains such conventions in the section about realm
> naming anyways.
> 
> > 
> > - pat
> > 
> 
> 
> Nico
> --
>

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 26 Sep 2000 16:20:07 -0400

Ah. Have you checked Windows 2000? I think it uses components that trail
the hostname.

And I could swear I've seen example SPNs with components trailing the
hostnames in some web pages. I'll have to look again.

Nico

--