Subject: RE: Section 7 Kerberos Revisions for comment

From: "Moore, Patrick" <[email-masked]>
Date: Tue, 26 Sep 2000 15:15:14 -0600

DCE also uses components that trail the hostname for many (maybe most) of
its RPC principals. We have lots and lots of them in the form
"hosts/<hostname>/self" (and <hostname> is not canonical, contains no dot.)
W2K princ names are similar (Windows RPC is an adaptation of DCE RPC).  It
never worried me that these can't be used for NT_SRV_HST style services -
they were never intended for that. 

Again, I'm trying to solve a real-world problem for DCE infrastructures in a
way that does not break things and can be cleanly implemented and
documented. If a solution involving parsing of dots or embedding slashes
better supports some W2K or X.500 installation, then I could live with that.

- pat

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Tuesday, September 26, 2000 2:20 PM
> To: Moore, Patrick
> Cc: [email-masked]'
> Subject: Re: Section 7 Kerberos Revisions for comment
> 
> 
> 
> Ah. Have you checked Windows 2000? I think it uses components 
> that trail
> the hostname.
> 
> And I could swear I've seen example SPNs with components trailing the
> hostnames in some web pages. I'll have to look again.
> 
> Nico
> 
> 
> On Tue, Sep 26, 2000 at 02:16:58PM -0600, Moore, Patrick wrote:
> > Re:
> > nico> You proposed allowing '/' characters in the 
> > nico> components, yes? Isn't that a problem? I mean, 
> > nico> won't you have to quote '/' characters and so on?
> > 
> > My proposal did not involve embedded slashes in component names. Ken
> > suggested that, and I agreed that I might be able to make 
> that work for us
> > if necessary.  But I still like my original proposal best: 
> simply that for
> > NT_SRV_HST we allow more than one component for the server name, and
> > continue to assume that the final component is the 
> hostname. I know how to
> > make this work, and see it as the cleanest 'do no harm' 
> modification to
> > support DCE infrastructures.
> > 
> > - pat
> --
>

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 26 Sep 2000 17:35:11 -0400

Well, that may be the solution: that the SPN NT_SRV_HST form depends on
the context. After all, the clients and services referencing or using
these SPNs should know the context in which they're used.

So then the NT_SRV_HST rules might be:

 - SPNs with 2 components must be of the form <service> / <host>

 - The form of SPNs with more than 2 components may vary according to
   the application. Specifically there can be two forms:

    - <service> / <host> / <component3> [ / ... / <componentN>]

    - <service> / <component2> [ / ... / <componentN> ] / <host>

Can we ban '.' from non-hostname SPN components (instances)? That, at
least, would allow a heuristic for determining the SPN form when context
is missing and FQDNs are used.

Any other strange SPN forms?

Nico

--