Subject: CONSENSUS CALL - #841 - AF-IF-RELEVANT[AD-INITIAL-VERIFIED-CAS]

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 14 Mar 2005 18:30:49 -0500

This is ticket #841.

Last month, there was a fairly lengthy discussion on the usage of 
AD-INITIAL-VERIFIED-CAS, and the semantics of when to wrap it in 
AD-IF-RELEVANT.  After about a week of this, I posted a fairly lengthy 
message detailing the consensus that had been reached in Boulder regarding 
this issue, and indicated it would be fairly difficult to revisit.  For all 
of the details, please see my message 'AD-INITIAL-VERIFIED-CAS', dated 
7-Feb-2005.

I also summarized a proposal Larry and Nico arrived at, which would allow 
the TGS to add or remove the AD-IF-RELEVANT wrapper depending on whether it 
had checked the CA path against local policy.  Specifically, Larry proposed 
the following text:

   The AS MAY wrap any AD-INITIAL-VERIFIED-CAS data in AD-IF-RELEVANT
   containers if the list of CAs satisfies the KDC's realm's policy
   (this corresponds to the TRANSITED-POLICY-CHECKED ticket flag).
   Furthermore, any TGS MUST copy such authorization data from tickets
   used in a PA-TGS-REQ of the TGS-REQ to the resulting ticket,
   and it can wrap or unwrap the data into or out-of the AD-IF-RELEVANT
   container, depends on if the list of CAs satisfies the local KDC's
   realm's policy

I am now attempting to determine whether there is a working group consensus 
to adopt the change proposed by Larry and Nico.  Both Sam and I have 
indicated a preference for the new text, but willingness to support the 
document with or without the change.

I would like to see comments from other members of the working group 
supporting or opposing this change.

-- Jeff

---

From: Brian Tung <[email-masked]>
Date: Tue, 15 Mar 2005 11:03:30 -0800

Jeffrey Hutzelman wrote:
> [snip]

I have read and share your sentiment.

Brian Tung <[email-masked]>

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Mar 2005 13:02:42 -0600

BTW, since the KDC did the verification, shouldn't the
AD-INITIAL-VERIFIED-CAS be inside a AD-KDC-ISSUED containter element,
which, in turn, would be inside a AD-IF-RELEVANT?

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 15 Mar 2005 15:05:25 -0500

Jeffrey Hutzelman wrote:

> Specifically, 
> Larry proposed the following text:
> 
> 
> I am now attempting to determine whether there is a working group 
> consensus to adopt the change proposed by Larry and Nico.  Both Sam and 
> I have indicated a preference for the new text, but willingness to 
> support the document with or without the change.
> 

Can the grammar in the second run on sent be fixed so I can determine 
whether this describes a "must always" or a "must depending on ...".

Thanks.