Subject: RE: Clarifications draft

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 31 Mar 2004 16:06:44 -0800

Nicolas Williams wrote:
> "Mandatory flag field?"  What "mandatory flag field?"

I meant the ticket flag field below.

    -- Encrypted part of ticket
      EncTicketPart   ::= [APPLICATION 3] SEQUENCE {
              flags                   [0] TicketFlags,

This new flag ("delegated") is not critical, and application servers may
not process it.

> I didn't quite understand what change you requested wrt your first
issue.

We just want to change the "MUST" into "SHOULD" in section 6.2.1:

     ... the name of the host SHOULD be lower case...

What do you think?

Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, March 31, 2004 3:57 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Altman; [email-masked]; JK Jaganathan; Sam Hartman;
[email-masked]
Subject: Re: Clarifications draft

On Wed, Mar 31, 2004 at 03:44:11PM -0800, Liqiang(Larry) Zhu wrote:
>  
> Nicolas Williams wrote:
> > I think such a flag would be best implemented as authorization data,
> as would the flag that MS > proposes.
> 
> For the anonymous flag, I do think it makes sense to implement it as 
> AD, but that is more out of personal preference than anything else.

This is silly.  You prefer my option be done as AD and I prefer your
option be done as AD.  What gives?  :)

> For the delegated ticket flag, however, we can mark the ticket in the 
> mandatory flag field, and record the delegating server 
> identity/identities inside the AD-IF-RELEVANT container.

"Mandatory flag field?"  What "mandatory flag field?"

There is no such thing, and though section 2 does not address the
application server side of ticket flag handling, it's pretty clear that
new ticket flags can't be expected to be critical.

Ergo you must use authorization data if you want this option to be
critical.

> > > lzhu wrote: 
> >> Can a server NOT on a host, or do we want to say the server is
> running
>                ^^^^^^^^^^^^^
> > Can't parse this.
> 
> I meant: is the description "a server on a host" too general? In other

> words, what is the difference between "a server on a host" and simply 
> "a server"?

I think what is ultimately meant is that the server must have a hostname
associated with it.

> > Jeffrey Altman wrote:
> > why is item 2 a topic for discussion of Clarifications and not
> Extensions?
> 
> Out of the two, one is a small editorial change, and we proposed the 
> other so that we can start to use the delegated ticket flag (if
> assigned) right away.

I didn't quite understand what change you requested wrt your first
issue.

As to the second, you need to clarify whether the proposed flags is
intended to be critical or not, and if it is then you cannot have it.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 31 Mar 2004 18:12:03 -0600

> This new flag ("delegated") is not critical, and application servers may

As long as it's not critical I don't see why it couldn't be added.

Adding it in clarifications though, is another story -- I'll defer to
the WG chairs on that matter.

>      ... the name of the host SHOULD be lower case...

I oppose.

I believe it's ok for the service to have principal names where the
hostname/domain label part(s) are not lower-cased, but I believe all
such services MUST also have a related name where the same components
are lower cased.  The reason is that clients today expect this.

So I oppose the proposed change.  But if you can re-word your proposal
to clarify that services may have _additional_ names where the hostname
is not lower cased I might agree.

Why do you want this anyways?  Is this at all related to Martin's issues
with Windows 2003 and its canonicalization issues?

Cheers,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 31 Mar 2004 19:45:07 -0600

> the WG chairs on that matter.

To clarify my position: if you want this non-critical flag then you
should specify it in a separate document -- there's no need to delay
clarifications.  If you change your mind and decide that you want a
critical flag then you must specify this feature through authorization
data.

I still welcome the opinion of the WG chairs, of course.

Nico
--