Subject: [Ietf-krb-wg] anonmous ID comments

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 12:15:38 -0700

* A019 Apr 04 Sam Hartman <hartmans-ietf at mit.edu>
  > How should anonymous realms interact with cross-realm policy?

Please review proposed text:

   If the client realm in a ticket is the anonymous realm, the
   authentication path is not defined; therefore in that case any realm
   in the authentication path is allowed by the cross-realm policy check
   and the TRANSITED-POLICY-CHECKED flag MUST NOT be set by the KDC.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 20 Aug 2008 11:27:12 -0400

What's wrong with the KDC setting the transited policy check flag?

Also, I'd say something like absent other information, any realm is
allowed: if you know that some realm does not support anonymous then
it may be reasonable to reject it appearing in the authentication
path.

---

From: Larry Zhu <[email-masked]>
Date: Wed, 20 Aug 2008 10:25:39 -0700

If that is too strong, would the following work?

<t>If the client realm in a ticket is the anonymous realm, absent other information any realm in the authentication path is allowed by the cross-realm policy check.</t>

---

From: Sam Hartman <[email-masked]>
Date: Wed, 20 Aug 2008 13:35:55 -0400

>>>>> "Larry" == Larry Zhu <[email-masked]> writes:

    Larry> If that is too strong, would the following work?  <t>If the
    Larry> client realm in a ticket is the anonymous realm, absent
    Larry> other information any realm in the authentication path is
    Larry> allowed by the cross-realm policy check.</t>

Works for me.