Subject: Re: Section 7 Kerberos Revisions for comment

From: Ken Raeburn <[email-masked]>
Date: 24 Nov 2000 01:11:42 -0500

From section 1:

> <DT>Principal <DD>A uniquely named client or server instance that
> participates in a network communication.
> 
> <DT>Principal identifier <DD>The name used to uniquely identify each
> different principal.

With name canonicalization, I think we've got text elsewhere
suggesting that a principal has multiple names, but most references to
"principal identifier" appear to mean the canonical form only.  (If
this isn't the case, 7.2.1 needs work.)

        <DT>Principal <DD>A named client or server entity that
        participates in a network communication, with one name that is
        considered canonical.

        <DT>Principal identifier <DD>The canonical name used to
        uniquely identify each different principal.

That may be little better, pushing off the key distinctions onto the
word "canonical".

> <H3>7.2.  Principal Names</H3>

> A name type of SMTP allows a name to be of a form that resembles a
> SMTP email name. This name type can be used in conjunction with
> name-canonicalization to allow a free-form of username to be specified
> as a client name and allow the KDC to determine the Kerberos principal
> name for the requested name.  [JBrezak]

This says nothing about the number of components or what they contain.
Is this one component of the form "[email-masked]", or is the right-hand
side of the email name intended to be used as the realm name?  Since
the latter may leave the client looking for realms that don't exist,
I'd assume the former, though that yields a complete printed form that
looks like "[email-masked]@FOO.COM".

How about:

	A name type of SMTP allows a name to be of a form that
        resembles a SMTP email name.  This name, including an "@" and
        a domain name, is used as the one component of the principal
        name.  This name type can be used in conjunction with
        name-canonicalization to allow a free-form of email address to
        be specified as a client name and allow the KDC to determine
        the Kerberos principal name for the requested name.

> <H4>7.2.1.  Name of server principals</H4>
> 
> The principal identifier for a server on a host will generally be
> composed of two parts: (1) the realm of the KDC with which the server
> is registered, and (2) a two-component name of type NT-SRV-HST if the
> host name is an Internet domain name or a multi-component name of type
> NT-SRV-XHST if the name of the host is of a form such as X.500 that
> allows slash (/) separators.  The first component of the two- or
> multi-component name will identify the service and the latter
> components will identify the host.  Where the name of the host is not
> case sensitive (for example, with Internet domain names) the name of
> the host must be lower case.  If specified by the application protocol
> for services such as telnet and the Berkeley R commands which run with
> system privileges, the first component may be the string 'host'
> instead of a service specific identifier.  When a host has an official
> name and one or more aliases, the official name of the host must be
> used when constructing the name of the server principal.

This last sentence is completely at odds with the whole name
canonicalization bit.  It should probably say "SHOULD"; that walks a
line between always canonicalizing (in which case we don't care), and
RFC1510 compatibility (where it would be a "MUST").

Ken