Subject: LAST CALL COMMENT CLARIFICATIONS Section 7.5.9 msg 68 description non-sensical

From: Ken Raeburn <[email-masked]>
Date: Mon, 23 Jun 2003 03:58:10 -0400

The description for error code 68, which appears to have been added in
the -03 draft:

>   KDC_ERR_WRONG_REALM               68 USER-TO-USER TGT issued different KDC

doesn't make any sense.  I don't know what it should be.

"issued by different KDC"?  If so, "by different realm" is probably
more apt.

Some email in 2001 on the kerberos@mit mailing list (10 Sep, between
Bjoern Brauel and Tom Yu) seems to indicate that the Microsoft AD can
return this in a misconfigured login attempt, which is unlikely to be
doing user-to-user authentication.  (That's not to say that it's
necessarily a valid error code for that situation, but it does appear
that at least one implementation is, or was, using it.)

At that point in time, we had kerberos-revisions, and the description
only said "(user-to-user)".

Showstopper?  I don't know.  Do we want to send a document to the IESG
knowing it's got nonsensical messages in it?

Ken