Subject: RE: CONSENSUS CALL - #841 - AF-IF-RELEVANT[AD-INITIAL-VERIFIED-CAS]

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 13 May 2005 19:27:08 -0700

[I apologize I am behind in the list discussion due to quite a few LH
issues recently]

No that was not what I intended.

Here is how I would rephrase:

  Furthermore, any TGS MUST copy such authorization data from tickets
  used within a PA-TGS-REQ of the TGS-REQ into the resulting ticket.  If
  the list of CAs satisfies the local KDC's realm's policy, the TGS MAY
  wrap the data into the AD-IF-RELEVANT container, otherwise it will 
  unwrap the authorization data out of the AD-IF-RELEVANT container.

Thoughts?

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Jeffrey Altman
Sent: Monday, April 18, 2005 11:56 AM
To: [email-masked]
Subject: Re: CONSENSUS CALL - #841 -
AF-IF-RELEVANT[AD-INITIAL-VERIFIED-CAS]

Larry:

Unfortunately, changing those words does not fix the grammar problems.
This is how I am currently parsing the last sentence:

  Furthermore, any TGS MUST copy such authorization data from tickets
  used within a PA-TGS-REQ of the TGS-REQ into the resulting ticket.  If
  the list of CAs satisfies the local KDC's realm's policy, the TGS MAY
  wrap or unwrap the data into or out-of the AD-IF-RELEVANT container.

Is this what you intended?

Jeffrey Altman

Liqiang(Larry) Zhu wrote:
> s/depends on if/based on whether/
> 
> 
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Jeffrey
Altman
> Sent: Tuesday, March 15, 2005 12:05 PM
> To: [email-masked]
> Subject: Re: CONSENSUS CALL - #841 -
> AF-IF-RELEVANT[AD-INITIAL-VERIFIED-CAS]
> 
> Jeffrey Hutzelman wrote:
> 
> 
>>Specifically, 
>>Larry proposed the following text:
>>
>>
>>  The AS MAY wrap any AD-INITIAL-VERIFIED-CAS data in AD-IF-RELEVANT
>>  containers if the list of CAs satisfies the KDC's realm's policy
>>  (this corresponds to the TRANSITED-POLICY-CHECKED ticket flag).
>>  Furthermore, any TGS MUST copy such authorization data from tickets
>>  used in a PA-TGS-REQ of the TGS-REQ to the resulting ticket,
>>  and it can wrap or unwrap the data into or out-of the AD-IF-RELEVANT
>>  container, depends on if the list of CAs satisfies the local KDC's
>>  realm's policy
>>
>>
>>
>>I am now attempting to determine whether there is a working group 
>>consensus to adopt the change proposed by Larry and Nico.  Both Sam
> 
> and 
> 
>>I have indicated a preference for the new text, but willingness to 
>>support the document with or without the change.
>>
>>I would like to see comments from other members of the working group 
>>supporting or opposing this change.
>>
>>-- Jeff
> 
> 
> Can the grammar in the second run on sent be fixed so I can determine 
> whether this describes a "must always" or a "must depending on ...".
> 
> Thanks.
> 
>

---

From: Jeffrey Altman <[email-masked]>
Date: Sat, 14 May 2005 11:12:15 -0400

This is clear.
Thank you.

Jeffrey Altman