Subject: Exposing the client realms of the anonymous client

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 10 Jul 2006 13:58:57 -0700

In kitten, we have discussed this in detail, see the minutes for more
information. please review the relevant text for this:

   GSS-API defines the name_type GSS_C_NT_ANONYMOUS [RFC2743] to
   represent the anonymous identity.  In addition, Section 2.1.1 of
   [RFC1964] defines the single string representation of a Kerberos
   principal name with the name_type GSS_KRB5_NT_PRINCIPAL_NAME.  For
   the anonymous principals, the name component within the exportable
   name as defined in Section 2.1.3 of [RFC1964] MUST signify the realm
   name according to Section 2.1.1 of [RFC1964].  In this specification
   only the client/initiator can be the anonymous identity.

   Portable initiators are RECOMMENDED to use default credentials
   whenever possible, and request anonymity only through the input
   anon_req_flag [RFC2743] to GSS_Init_Sec_Context().

Here is the diff out:
>    GSS-API defines the name_type GSS_C_NT_ANONYMOUS [RFC2743] to
329,331d332
<    Portable initiators are RECOMMENDED to use default credentials
<    whenever possible, and request anonymity only through the input
<    anon_req_flag to GSS_Init_Sec_Context().
334,335c335
<
< Zhu, et al.             Expires December 5, 2006                [Page
6]
---
> Zhu, et al.             Expires December 3, 2006                [Page
6]
339a340,352
>    represent the anonymous identity.  In addition, Section 2.1.1 of
>    [RFC1964] defines the single string representation of a Kerberos
>    principal name with the name_type GSS_KRB5_NT_PRINCIPAL_NAME.  For
>    the anonymous principals, the name component within the exportable
>    name as defined in Section 2.1.3 of [RFC1964] MUST signify the
realm
>    name according to Section 2.1.1 of [RFC1964].  In this
specification
>    only the client/initiator can be the anonymous identity.