Subject: pk-init-34: user principal name encoding

From: Paul Nelson <[email-masked]>
Date: Fri, 24 Mar 2006 16:19:09 -0600

I'm working on encoding the stuff for my PKINIT AS-REQ KDC-REQ-BODY

0 - options
1 - cname  -  KRB_NT_PRINCIPAL, etc.
2 - realm
3 - sname - KRB_NT_SRV_INST   (krbtgt/REALM.XXX)

This may be more of an Active Directory question, but I'm uncertain how to
encode [1] (cname).

Also, for the realm name, RFC4210 says this is the realm of the server AND
the clients principal identifier.  Is this still true with PKINIT?

Here's the problem.  If I have a certificate authority trusted by Active
Directory (like the DoD CAC), and I've added users to the domain in the form
"1160067507@mil".  I've set the user's "account name" to be 1160067507@mil
(this sets the userPrincipalName attribute in Active Directory).

In draft-ietf-cat-kerberos-pk-init-34, section 3.2.2 page 16, I think this
is addressed in the item numbered "2."

A DoD CAC has the Subject Alternative Name with a 1.3.6.1.4.1.311.20.2.3
(User principal name) item that contains "1160067507@mil"  So the user's
principal name is "1160067507@mil", but the realm we send the AS-REQ to will
be something else, like XXX.US.ARMY.MIL.

Does the info on page 16 apply here?

Is the item numbered "2." on page 16 saying my certificate must have the SAN
encoded using "1.3.6.1.5.2.2 (x509SanAN)?  Is this section talking about the
certificate or KDC-REQ-BODY/cname?

How do I encode the KDC-REQ-BODY/cname?  This is not referenced in the
current draft.

Also - section 3.2.2 of the draft goes on for about four pages without
additional numbering.  There are at least four distinct topics here.  How
about adding some subsections?

Paul Nelson
Thursby Software Systems, Inc.