Subject: [Ietf-krb-wg] Bug in anonymous draft: one realm in kdc-req

From: Sam Hartman <[email-masked]>
Date: Mon, 14 Dec 2009 14:46:33 -0500

I'm trying to implement anonymous draft 10.
However,  there's some confusion about the realm in the AS request.

Based on the draft, I think I should be requesting a client principal of
WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS for krbtgt/SOMEREALM@SOMEREALM.

You can't do that: there is only one realm in the ASN.1 sequence for a
kdc request body.

I could request KRBTGT/WELLKNOWN:ANONYMOUS@WELLKNOWN:ANONYMOUS.  That's
kind of problematic for a number of implementation reasons, and it would
be somewhat unclear what to do with the resulting credential.  Would I
have to go get a cross-realm ticket to the real realm?  ETc.  I think we
should revise the draft.  I think clients should send an AS REQ for
WELLKNOWN/ANONYMOUS@REAL_REALM for KRBTGT/REAL_REALM@REAL_REALM.
The client should expect the server to return a credential for
WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS for
KRBTGT/REAL_REALM@REAL_REALM.

Does this make sense?

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Fri, 18 Dec 2009 11:01:38 +0000

Hi Sam,
First let me summarize what is allowed in the AS request based on the current draft: the client name is WELLKNOWN/ANONYMOUS, and the realm is REAL_RALM, and the server name is KRBTGT/REAL_REALM, and in the returned ticket, the client name is WELLKNOWN/ANONYMOUS, and the server name is KRBTGT/REAL_REALM, and the server realm is REAL_REALM.

Then what is the client realm in the returned ticket, it could be either REAL_REALM or WELLKNOWN:ANONYMOUS, both are allowed and it is up to the KDC to decide.

Now back to your question, you are attempting to request a ticket for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS, that is not expressible in AS-REQ because it only allows one to specify the client name, not the client realm name, right?

Thanks.

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Monday, December 14, 2009 11:47 AM
To: [email-masked]
Cc: Larry Zhu
Subject: Bug in anonymous draft: one realm in kdc-req

Does this make sense?

---

From: Sam Hartman <[email-masked]>
Date: Fri, 18 Dec 2009 15:29:54 -0500

>>>>> "Larry" == Larry Zhu <[email-masked]> writes:

    Larry> Hi Sam, First let me summarize what is allowed in the AS
    Larry> request based on the current draft: the client name is
    Larry> WELLKNOWN/ANONYMOUS, and the realm is REAL_RALM, and the
    Larry> server name is KRBTGT/REAL_REALM, and in the returned ticket,
    Larry> the client name is WELLKNOWN/ANONYMOUS, and the server name
    Larry> is KRBTGT/REAL_REALM, and the server realm is REAL_REALM.

    Larry> Then what is the client realm in the returned ticket, it
    Larry> could be either REAL_REALM or WELLKNOWN:ANONYMOUS, both are
    Larry> allowed and it is up to the KDC to decide.

I don't think both are allowed by the current draft at least in the AS
case.  As I read the current text the KDC MUST return
WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS.

In the TGS case, I think things are less clear, although I think you end
up with WELLKNOWN/ANONYMOUS@REAL_REALM.

    Larry> Now back to your question, you are attempting to request a
    Larry> ticket for WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS, that is
    Larry> not expressible in AS-REQ because it only allows one to
    Larry> specify the client name, not the client realm name, right?

Yes.

---

From: Greg Hudson <[email-masked]>
Date: Mon, 21 Dec 2009 16:52:36 -0500

> WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS for krbtgt/SOMEREALM@SOMEREALM.

I believe there is some confusion here stemming from whether the
"anonymous principal" is WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS or just
WELLKNOWN/ANONYMOUS.  The contentious statements are, I think:
        
        [4.1]: If the client name in the request is the anonymous
        principal, the client realm (crealm) in the reply is the
        anonymous realm, otherwise the client realm is the realm of the
        AS.

        [4.1.1]: the client sets the client name as the anonymous
        principal in the AS exchange

If "the anonymous principal" includes the realm, then such statements
are inconsistent with setting the realm to the real Kerberos realm as
mandated in section 4.3.  If "the anonymous principal" refers only to
the name WELLKNOWN/ANONYMOUS, then the requirements are consistent.

I think the intent of the draft is clearly that "the anonymous
principal" refers only to the principal name (without realm), and that a
fully anonymous request should have:

* kdc-options including anonymous
* cname of WELLKNOWN/ANONYMOUS
* realm of the real-kerberos-realm
* sname of krbtgt/real-kerberos-realm

---

From: Sam Hartman <[email-masked]>
Date: Mon, 21 Dec 2009 21:30:29 -0500

Greg, we're in agreement about the intent of the draft.  Our
implementation conforms to the intent of the draft so far as I am aware.

so, this may just be me misreading or it may be that we need a minor
clarification.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg