Subject: RE: disallow requests naming principal as a service

From: "Moore, Patrick" <[email-masked]>
Date: Fri, 22 Mar 2002 13:45:52 -0700

Making account flags match up with DCE is 
not that important. Supporting the feature 
-- allowing a given princ to be a U2U service but 
not a conventional service -- is very important.
I understand that MSoft KDC's will soon
support the feature.

The DCE approach might be reasonable, even 
though it does involve another acct flag.
DCE account flags are called
'server' dupkey' and 'usertouser', with 
'server no' equivilent to DISALLOW_SVR and
'dukey no' equivilent to DISALLOW_DUP_SKEY.
They work as described in the table below:

Result            server flag   dupkey flag usertouser flag 
==========       ===========   =========== =============== 
KDC will not 
issue a service       no        any        any 
ticket 

KDC will only 
issue 'conventional'  yes        no         any 
tickets 

KDC will only 
issue usertouser      yes        yes        yes 
tickets 

KDC will issue 
conventional or       yes        yes         no 
usertouser tickets 
-----------------------------------------------------       

-----Original Message-----
> From: Matt Crawford Sent: 3/21/2002 7:19 PM

  Pat>> This is the reason another flag is needed so that a user is allowed
as
  Pat>> a service, but only via the ENC-TKT-IN-SKEY option, so that you can
  Pat>> authenticate to users as a service, but without exposing a 
  Pat>> conventional TGS_REP to attack on a user's key.

Matt> It was pointed out to me in private mail (I don't know why, the
Matt> sender isn't usually shy) that DISALLOW_SVR in MIT's KDC does stop
Matt> user-to-user.  Since there already exists a separate
Matt> DISALLOW_DUP_SKEY flag this surprised me, but it seems to be true.
Matt> I suggest that the MIT krb5 has all the flags it needs, it just
Matt> doesn't use them properly.  Still, they probably have to invent a new
Matt> one to avoid breaking some existing deployment somewhere ......