Subject: OID for a Kerberos principal name in an X509 subject DN?

From: Matt Crawford <[email-masked]>
Date: Wed, 11 Sep 2002 08:47:16 -0500

Is there a correct OID to use for including a Kerberos principal name
in a DN?  Is it one of

	1.2.840.113554.1.2.2.1 - gss-krb5-nt-principal-name
		(...mit infosys gssapi krb5 krb5_name)
or
	1.3.6.1.5.6.4 - gss-api-exported-name

or something completely different?

---

From: Martin Rex <[email-masked]>
Date: Wed, 11 Sep 2002 20:37:23 +0200 (MET DST)

> 		(...mit infosys gssapi krb5 krb5_name)

Maybe but not quite.

This OID is primarily for use with GSS-API and it indicates that
the accompanying (printable) octet string represents a Kerberos principal
name according to the rules of rfc-1964.

However, the definition in rfc-1964 is not very precise, so there are
two things you should beware of:
- the accompanying printable is encoded in whatever is the local
  character set (usually ASCII, but EBCDIC still exists on some machines...)
- there is the same just-send-8 (bit) confusion as in the Kerberos ticket
  protocols (only that the Kerberos protocol requires the ASCII 7-bit subset).

> 	1.3.6.1.5.6.4 - gss-api-exported-name

No, _this_ particular OID is strictly tied to the output of
the GSS-API call gss_export_name() and must be used for *ALL*
gssapi mechanisms that support this GSS-API v2 functionality.
To be exact, this OID indicates that the accompanying binary blob
uses an outer generic framing as described in RFC2743, Section 3.2.

> or something completely different?

I would recommend to fork a new OID from the MIT OID-space
and create a clean specification on the format, especially
about how to transform from/to representations that do not
fit into ASCII 7-bit (probably by using an UTF8-String).

-Martin