Subject: RE: Clarifications draft

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 31 Mar 2004 15:51:16 -0800

Nicolas Williams wrote:
>As for host-based hostnames, I believe RFC1964 and CFX are the
controlling authority here: you 
>can use host-based principal names that don't have exactly two
components (<service> / 
><hostname>) only in non-GSS contexts (or, for that matter, only in
contexts where clients know 
>what to do), else you'll have interop problems.

I do not understand, where do we restrict the number of components in
the pricipal names to exactly two in 1964 and CFX? Can you give me more
specific references? This is certainly not the case for our SSPI
implementation.

Thanks,

Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, March 31, 2004 3:04 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; JK Jaganathan; Sam Hartman; [email-masked]
Subject: Re: Clarifications draft

On Wed, Mar 31, 2004 at 02:43:02PM -0800, Liqiang(Larry) Zhu wrote:
> Two comments:
> 
> 1) Is the following "MUST" too strong.
> 
> In section 6.2.1:
> 
>       The principal identifier for a server on a host will generally
be
>       composed of two parts: ... the name of the host MUST be lower   
>       case...
> 
> Can a server NOT on a host, or do we want to say the server is running
               ^^^^^^^^^^^^^
Can't parse this.

> as the local host here? Secondly it says the name is "generally"
> composed of two parts, would that imply everything follows it can not 
> be more than a "SHOULD"? Thirdly, since name types do not partition 
> the name space, does it imply all host names used as the instance must

> be lowercase?
> 
> Can we consider using a "SHOULD" here? I do not know if I missed 
> anything elsewhere in the draft that would also imply host names MUST 
> be lowercase.

I think we've already agreed on an IDN strategy and that should inform
us with respect to non-IDNs: wherever hostnames (domainnames) are used
as components of principal names their domain labels MUST be lower-case
if they are ASCII (i.e., non-IDN cases).  Anything else may not interop.

As for host-based hostnames, I believe RFC1964 and CFX are the
controlling authority here: you can use host-based principal names that
don't have exactly two components (<service> / <hostname>) only in
non-GSS contexts (or, for that matter, only in contexts where clients
know what to do), else you'll have interop problems.

Cheers,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 31 Mar 2004 18:05:29 -0600

> specific references? This is certainly not the case for our SSPI

RFC1964 doesn't say it, but all non-Windows clients map
GSS_C_NT_HOSTBASED_SERVICE forms to <service>/<hostname>@<REALM> as per
the NT-SRV-HST Kerberos V name type.  Thus if some service
implementation did not follow this convention it would not be able to
interop with such clients.

It is perfectly possible, of course, for GSS-API acceptors to have
additional names of other forms, and it's possbile for some clients to
prefer such forms for GSS_C_NT_HOSTBASED_SERVICE names too, but all
initiators and acceptors MUST be able to deal with
GSS_C_NT_HOSTBASED_SERVICE names for the Kerberos V mechanism mapping to
<service>/<hostname>@<REALM>.

Nico
--