Subject: Re: pk-init-34: user principal name encoding

From: Luke Howard <[email-masked]>
Date: Sat, 25 Mar 2006 10:13:38 +1100

Paul,

>A DoD CAC has the Subject Alternative Name with a 1.3.6.1.4.1.311.20.2.3
>(User principal name) item that contains "1160067507@mil"  So the user's
>principal name is "1160067507@mil", but the realm we send the AS-REQ to will
>be something else, like XXX.US.ARMY.MIL.

Windows PKINIT clients send a KRB-NT-ENTERPRISE-PRINCIPAL in the AS-REQ
with a single name-string containing the UPN and the realm being that
which the machine is joined to.

eg.

cname ::= {
	KRB-NT-ENTERPRISE-PRINCIPAL,
	{ "1160067507@mil" }
}
realm ::= "XXX.US.ARMY.MIL"

cheers,

-- Luke

--

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 27 Mar 2006 10:18:57 -0600

> which the machine is joined to.

I am under the impression that Vista will lift a lot of the restrictions
which are currently in place in W2K3 for example the need for the enterprise
principal being in the certificate.

With a PKI like the one used by DoD with CAC or the PKI that will be used
with FIPS-201 and PIV cards, The certificates will be issued by federal
agencies. Local AD domains will need to be able to use these agency
issued certificates and map to domain users. Thus the same certificate
on a card might be usable at many different domains.

So the confusion about what is needed with PKINIT in W2K3 vs CAC might have
more to do with limitations currently imposed by W2K3's policies on what is
in a certificate.

-- 

  Douglas E. Engert  <[email-masked]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444