Subject: RE: pkinit comments - cert->realm/princ determination and other

From: Tim Alsop <[email-masked]>
Date: Tue, 19 Nov 2002 19:58:07 -0000

May I suggest that each KDC and client vendor who allready has support for
PKINIT and all vendors who implement PKINIT in future products need to adopt
a consistent and interoperable method for cert to principal/realm mapping,
but also have the capability to support other mapping methods. It would also
be great if the KDC could determine, based on information in the AS-REQ
which mapping method to use before returning the appropriate AS-REP. If the
KDC does not support the mapping method requested at the client then an
appropriate error response can be sent to the client and the authentication
request denied.

With this approach it would be possible (for example) for a KDC to be
configured to support the mapping from PKINIT code provided in Win2k/XP
clients and also the same KDC could support a different form of mapping for
other clients/devices in the same network. Would it be possible (or is it
allready considered) to have some code in the KDC that determine the PKINIT
draft version used by the client and could a mapping type indicator be
transferred in the AS-REQ in some way to provide this functionality ?

The draft should describe a consistent baseline mapping approach, but should
also clearly state that there is a capability for alternative mapping
methods to be supported by some KDC's. If this is possible and desired then
the mapping determination method for the KDC should be documented.

Cheers, Tim.

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: 19 November 2002 15:53
To: [email-masked]
Cc: Tim Alsop; [email-masked]
Subject: Re: pkinit comments - cert->realm/princ determination and other

>>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:

    Jeffrey> I agree that the draft should not contain a MUST
    Jeffrey> implement mechanism for mapping Certs to Principals.
    Jeffrey> However, there does need to be a mechanism by which Cert
    Jeffrey> to REALM mapping is ensured to work.

Can you get interoperability without such a must implement mechanism?

---

From: Lars Johansson <[email-masked]>
Date: Wed, 20 Nov 2002 12:39:05 +0100

Dear Tim and all,                                                     
                                                                      
I strongly recommend NOT to mandate any mapping method                
from X.509 certificates to Kerberos principal/realm name.             
IMHO this mapping should be decided by the Kerberos                   
administrator, not by the vendors or standard setting bodies.         
                                                                      
It should especially be avoided to specify any requirements           
on the X.509 certificate content in PKINIT.                           
                                                                      
I can forsee situations where the client principals already           
have certificates (sometimes with the private key stored              
on a smart card), issued by a third party that had no idea            
of what Kerberos realm the certificate holder should become           
part of or even his/hers principal name. It should be up to           
the Kerberos or (internal) network administrator to decide            
whether or not to accept the client's (third party) certificate       
and to set up the mapping from the certificate content to the         
Kerberos realm/principal name.                                        
                                                                      
Kind regards!                                                         
_________________________________________________                     
Lars Johansson | Consultant                                           
[email-masked] | www.omegapoint.se                      
phone +46 70-915 88 40 | fax +46 8-517 008 29                         
Omegapoint AB - din säkra punkt i tillvaron