Subject: Re: pkinit comments - cert->realm/princ determination and other

From: Jeffrey Altman <[email-masked]>
Date: Tue, 19 Nov 2002 11:19:55 EST

> >>>>> "Jeffrey" == Jeffrey Altman <[email-masked]> writes:
> 
>     Jeffrey> I agree that the draft should not contain a MUST
>     Jeffrey> implement mechanism for mapping Certs to Principals.
>     Jeffrey> However, there does need to be a mechanism by which Cert
>     Jeffrey> to REALM mapping is ensured to work.
> 
> Can you get interoperability without such a must implement mechanism?
> 
> 
> 

Define what type of interoperability you expect to have?

I do not see a need to require that when I present a cert to KDC A and
KDC B that I get back the same principal.   I might have a cert that
is signed by a CA that is trusted by both CC.COLUMBIA.EDU and
ATHENA.MIT.EDU.  When I present it as part of an AS-REQ I may get back
[email-masked] or [email-masked] depending on the KDC
it is sent to.

However, there is in my mind a requirement that the REALM associated
with the CA that signed the cert that I am presenting to the KDC be
uniquely defined.  Conversions from Distinguished Name of the CA to
a REALM name is not only difficult but the resulting translations
cannot be reversed and they are inherently unreadable by users.  I
would much prefer that an extension be defined to specify this
mapping.  This should be a MUST.

It would also be nice for there to be an optional extension that
allows the principal name(s) to be specified.  Much in the same way
that a cert can contain multiple subjectAltNames specifying alternates
names for a given host; or mail user.

 Jeffrey Altman * Sr.Software Designer     Kermit 95 2.0 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 19 Nov 2002 11:26:50 -0500

>>  Can you get interoperability without such a must implement

    Jeffrey> Define what type of interoperability you expect to have?

I want to be able to use a client from any implementation from a KDC
with any other implementation.

I might actually want to be able to use one vendor's CA with another
vendor's KDC as well.