Subject: [Ietf-krb-wg] kerberos client realm and the anonmity realm

From: Larry Zhu <[email-masked]>
Date: Thu, 14 Aug 2008 12:42:24 -0700

As discussed in the meeting at Dublin, we would like to turn off the ability by the KDC to replace a client realm with the anonymous realm. In the recent list discussion there is already text in the current draft that prevents that but the proposed text can clarify that given the confusions around this area.

Section 4.1

   When policy allows, the KDC issues an anonymous ticket.  If the
   client name in the request is the anonymous principal, the client
   realm (crealm) in the reply is the anonymous realm, otherwise the
   client realm is the realm of the AS.  According to [RFC4120] the
   client name and the client realm in the EncTicketPart of the reply
   MUST match with the corresponding client name and the client realm of
   the anonymous ticket in the reply; the client MUST use the client
   name and the client realm returned in the KDC-REP in subsequent
   message exchanges when using the obtained anonymous ticket.

Section 4.2

   When policy allows, the KDC issues an anonymous ticket.  If the
   ticket in the TGS request is an anonymous one, the client name and
   the client realm are copied from that ticket; otherwise the ticket in
   the TGS request is a normal ticket, the returned anonymous ticket
   contains the client name as the anonymous principal and the client
   realm as the true realm of the client.  In all cases, according to
   [RFC4120] the client name and the client realm in the EncTicketPart
   of the reply MUST match with the corresponding client name and the
   client realm of the anonymous ticket in the reply; the client MUST
   use the client name and the client realm returned in the KDC-REP in
   subsequent message exchanges when using the obtained anonymous
   ticket.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg