Subject: RE: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 19 Oct 2005 14:02:00 -0700

The client needs to know if the KDC understands the request-anonymous
KDC option, for that reason we need to the anonymous ticket flag. This
is because RFC4120 compliant KDCs ignore unknown KDC options.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, October 19, 2005 12:19 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]
Subject: Re: FW: I-D ACTION:draft-zhu-kerb-anon-00.txt

On Wed, Oct 19, 2005 at 10:43:03AM -0700, Liqiang(Larry) Zhu wrote:
> just to state the obvious,  the anonymous principal name and empty
> realm is the IN/MN, and can be mapped to anonymous@anonymous as the
> printable name, you can call GSS_Import_name() with
> anonymous@anonymous <mailto:anonymous@anonymous>  to work with this
> extension, if necessary.

Yes, this is obvious.

> I also have a few comments on the proposal of using critical authz
> data, the client need to verify the ticket is anonymous, so using this
> alone does not help the client. On the other hand, the use of empty
> client principal name is in spirit equivalent of using critical authz
> data, in the sense it can not be ignored by KDCs, at least I can not
> think of a reason why the KDCs can ignore these.

The client can't verify that the ticket is for anonymous -- the
cname/crealm are inside the Ticket after all, as is the authz-data.

The client just has to trust the KDC; that's how it is now, without
anonymous principals.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 19 Oct 2005 16:16:04 -0500

> is because RFC4120 compliant KDCs ignore unknown KDC options.

That's what AD-MANDATORY-FOR-KDC is there for :)