Subject: Re: [Ietf-krb-wg] I-D Action:draft-ietf-krb-wg-iakerb-02.txt

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 16 Dec 2011 20:03:21 -0500

On Thu, 2009-07-30 at 23:30 -0700, [email-masked] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Kerberos Working Group of the IETF.
> 
> 
> 	Title           : Initial and Pass Through Authentication Using Kerberos V5 and the GSS- API (IAKERB)
> 	Author(s)       : L. Zhu, J. Altman
> 	Filename        : draft-ietf-krb-wg-iakerb-02.txt
> 	Pages           : 10
> 	Date            : 2009-07-30

I seem to have rather badly dropped the ball on this.  As of August
2009, this document appears to have been ready to go, except for lacking
a review and writeup from me.  Unfortunately, I don't seem to have ever
done that.

I'd like to go ahead and do so now, but I'd also like to offer an
opportunity for folks to make comments on this document based on
implementation experience.

-- Jeff

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Luke Howard <[email-masked]>
Date: Sun, 18 Dec 2011 21:41:54 +1100

MIT implements an earlier version of the draft with IAKERB_FINISHED (1) instead of GSS_EXTS_FINISHED (2).

There was an issue in the earlier version where it wasn't specified that the IAKERB OID must always be used, but I think that's fixed now. (GS2 requires that the messages use the OID of the selected mechanism in the first message, and this could be an issue if you select IAKERB but already have tickets; you must send the AP-REQ with the IAKERB rather than the Kerberos OID.)

-- Luke