Subject: Re: [Ietf-krb-wg] please cast your vote: do we need a standard way

From: Martin Rex <[email-masked]>
Date: Mon, 13 Oct 2008 21:11:29 +0200 (MEST)

Larry Zhu wrote:
> 
> Martin Rex wrote:
> > If two distinct principals userA@REALM1 and userB@REALM1 using distinct
> > Kerberos passwords want to acquire an anonymous credential
> > WELLKNOWN/ANONYMOUS@REALM1, then I assume that each one would have
> > to supply his very own password (if any) in a non-standardized
> > fashion, rather than both supplying a (wellknown?!?) password
> > of the principal "WELLKNOWN/ANONYMOUS@REALM1".
> 
> Should we use "WELLKNOWN/ANONYMOUS\userA@REALM1" or
> "WELLKNOWN/ANONYMOUS\userB@REALM1" to name these credentials
> objects in your example? This looks ugly but seems to work.

*I* didn't mean to suggest such naming.  I wanted the exact opposite,
both users should succeed with specifying "WELLKNOWN/ANONYMOUS@REALM1",
i.e. the same name that the acceptor is going to receive as src_name
upon authentication and that gss_inquire_cred() should return.

GSS-API v2 does not define anonymous credentials at all, only
anonymous authentication -- and it indicates that posession of
explicit/named credentials may be necessary as a prerequisite.

If gss_acquire_cred() is called for an anonymous principal (or
partly-anonymous principal), this may require the gssapi mechanism
to first create/obtain a default credential, then create/obtain
a (partial) anonymous credential and finally return a handle
to the (partial) anonymous credential to the caller of gss_acquire_cred().

How to do that exactly, and what it means for local user prompting
of passwords is entirely implementation defined.

The other issue to think about is what are "portable" application
callers are going to do / expected to do in order to make use
of anonymous authentication with Kerberos.

One possible approach for the Kerberos mechanism spec would be to
define that:

Unless a fully-anonymous credential(TGT) is available (or can
be obtained), a callers request for anonymous authentication,
i.e. passing GSS_C_ANONYMOUS_FLAG and GSS_C_NO_CREDENTIAL
to gss_init_sec_context() should result in partial anonymous
authentication, or regular authentication if anonymous authentication
is not available -- aligned with the general gssapi principle that
"a successful security context establishment is more important than
meeting all request attributes".

If that approach is chosen, then we should really define an
additional context attribute to indicate partial anonymous
authentication in order to *NOT* require the initiator to
inquire and parse the security context directly after the initial
call to gss_init_sec_context() in order to find out what exactly
happened.

If in addition, the concept of an anonymous credential is
introduced, then *I* think it would be correct for gss_init_sec_context()
to fail if a partial anonymous or fully anonymous credential is
passed as an explicit credential handle and anonymous authentication
is not possible for any reason.

The only requirement that I personally have for gss_acquire_cred()
and explicit anonymous names is that it be as simple and straight-forward
as possible.  "WELLKNOWN/ANONYMOUS\userB@REALM1" does not look simple
and straight forward to me.  "WELLKNOWN/ANONYMOUS@REALM1" is fine
if that is also what the acceptor is going to see.

-Martin

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Mon, 13 Oct 2008 21:09:57 -0700

Martin Rex wrote:
> If gss_acquire_cred() is called for an anonymous principal (or partly-anonymous principal), this may require the gssapi mechanism to >
> first create/obtain a default credential, then create/obtain a (partial) anonymous credential and finally return a handle to the >
> (partial) anonymous credential to the caller of gss_acquire_cred().

Can you expand on this? If you already have a partially-anonymous credential using implementation specific means, why do you need to call gss_acquire_cred() with the desired_name="WELLKNOWN/ANONYMOUS@REALM1"? And if there are two partially-anonymous credentials, one for userA@REALM1 and the other for userB@REALM1, how does gss_acquire_cred() know which one to pick?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Martin Rex
Sent: Monday, October 13, 2008 12:11 PM
To: Larry Zhu
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-krb-wg] please cast your vote: do we need a standard way

-Martin