Subject: Re: [Ietf-krb-wg] Kerberos anonymity and GSS-API names

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 01 Oct 2008 16:50:20 -0400

--On Tuesday, September 23, 2008 03:33:55 PM -0500 Nicolas Williams 
<[email-masked]> wrote:

> On Tue, Sep 23, 2008 at 04:28:35PM -0400, Sam Hartman wrote:
>> Where I think Larry and I disagree is about where that localization
>> happens.  I think that despite the intention of some GSS-API designers
>> people do use the output of gss_display_name in ways for which
>> localization of Kerberos principals would be highly problematic.  So,
>> I don't think that's the best place  to do the localization.
>
> Right, so we can always add GSS_Display_name_localized() if we really
> care.
>
> Apps cannot localize names unless the number of names to localize is
> small and their display syntax *trivial* and easily recognized.
>
> For now I propose that we either rule L10N out of scope for
> GSS_Display_name() or add GSS_Display_name_localized().

It appears to me that we have consensus on some issues here...

There appears to be consensus that gss_display_name on a fully-anonymous 
name should return GSS_C_NT_ANONYMOUS with a display string constructed in 
the same way as for GSS_KRB5_NT_PRINCIPAL; that is, it will look something 
like "WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS".

There appears to be consensus that gss_display_name should work this way 
both for names resulting from gss_accept_context and for those resulting 
from import of an anonymous name.

There appears to be rough consensus that Kerberos GSS-API mechanism 
implementations _not_ be permitted to return a "localized" display name 
string instead of the one described above.

It seems to be the sense of the group that strings returned by 
gss_display_name, while nominally intended for presentation, are in fact 
actually used as identifiers both by code and by users in ways that would 
be compromised if mechanism implementations were to localize them or in 
some other way use implementation-specific values.

It seems to be the sense of the group that it would be acceptable for 
GSS-API applications to present anonymous principals and contexts to the 
user in whatever way makes the most sense for the application and user, 
which may include a localized presentation.

It is out of scope for this WG to define constraints for how mechanisms 
should handle gss_display_name or to introduce gss_display_name_localized; 
those who are interested in those things should take them to KITTEN. 
However, it is in scope to specify the behavior of gss_display_name as it 
applies to the Kerberos mechanism, and I think we have consensus to do so.

Does anyone want to disagree with my assertion that we have reached 
consensus on these points?

-- Jeff
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg