Subject: [Ietf-krb-wg] Late Last Call Comment: draft-ietf-krb-wg-naming-04.txt

From: Sam Hartman <[email-masked]>
Date: Thu, 20 Mar 2008 10:57:02 -0400

I think there is a minor ambiguity in  the naming draft:

>Consequently, unless otherwise
>   specified, a well-known Kerberos realm name MUST NOT be present in transited encoding

Who enforces this requirement?  That's an important question because
it controls who needs to support the specific well known realm in
order for it to be used.

In general using passive voice for such requirements is a really bad idea.

I'd recommend something like: Unless otherwise specified, parties
checking the transited realm path MUST reject a transited realm path
that includes a well known realm.  In the case of KDCs checking the transited realm path, this means that the transited policy checked flag MUST NOT be set in the resulting ticket.

In particular, that means that a KDC that is not checking transited
realm paths is not encouraged to reject a request simply because the
realm in an unknown well known realm.

--Sam
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg