From kitten-bounces@lists.ietf.org Tue Aug 07 10:15:40 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IIPqU-0002AS-PE; Tue, 07 Aug 2007 10:15:38 -0400 Received: from kitten by megatron.ietf.org with local (Exim 4.43) id 1IIPqQ-000270-4r for kitten-confirm+ok@megatron.ietf.org; Tue, 07 Aug 2007 10:15:34 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IIPqP-000258-K3 for kitten@lists.ietf.org; Tue, 07 Aug 2007 10:15:33 -0400 Received: from ns4.neustar.com ([156.154.24.139]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IIPqO-0007bZ-KH for kitten@lists.ietf.org; Tue, 07 Aug 2007 10:15:33 -0400 Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns4.neustar.com (Postfix) with ESMTP id 7EF842AC64; Tue, 7 Aug 2007 14:15:02 +0000 (GMT) Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1IIPpu-0003wq-8h; Tue, 07 Aug 2007 10:15:02 -0400 Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 To: i-d-announce@ietf.org From: Internet-Drafts@ietf.org Message-Id: Date: Tue, 07 Aug 2007 10:15:02 -0400 X-Spam-Score: 0.0 (/) X-Scan-Signature: 14582b0692e7f70ce7111d04db3781c8 Cc: kitten@lists.ietf.org Subject: I-D ACTION:draft-ietf-kitten-rfc2853bis-03.txt X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kitten-bounces@lists.ietf.org --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kitten (GSS-API Next Generation) Working Group of the IETF. Title : Generic Security Service API Version 2 : Java Bindings Update Author(s) : M. Upadhyay, S. Malkani Filename : draft-ietf-kitten-rfc2853bis-03.txt Pages : 96 Date : 2007-8-7 The Generic Security Services Application Program Interface (GSS-API) offers application programmers uniform access to security services atop a variety of underlying cryptographic mechanisms. This document updates the Java bindings for the GSS-API that are specified in "Generic Security Service API version 2 : Java Bindings" (RFC2853). This document obsoletes RFC 2853 by making specific and incremental clarifications and corrections to it in response to identification of transcription errors and implementation experience. The GSS-API is described at a language independent conceptual level in "Generic Security Service Application Program Interface Version 2, Update 1" (RFC2743). The GSS-API allows a caller application to authenticate a principal identity, to delegate rights to a peer, and to apply security services such as confidentiality and integrity on a per-message basis. Examples of security mechanisms defined for GSS- API are "The Simple Public-Key GSS-API Mechanism" (RFC2025) and "The Kerberos Version 5 GSS-API Mechanism (RFC4121). A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-rfc2853bis-03.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-kitten-rfc2853bis-03.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-kitten-rfc2853bis-03.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2007-8-7090728.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-kitten-rfc2853bis-03.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-kitten-rfc2853bis-03.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2007-8-7090728.I-D@ietf.org> --OtherAccess-- --NextPart Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten --NextPart-- From kitten-bounces@lists.ietf.org Sat Aug 11 09:49:30 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IJrJf-0008ON-EV; Sat, 11 Aug 2007 09:47:43 -0400 Received: from kitten by megatron.ietf.org with local (Exim 4.43) id 1IJrJe-0008OG-AM for kitten-confirm+ok@megatron.ietf.org; Sat, 11 Aug 2007 09:47:42 -0400 Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IJrJe-0008O7-0O for kitten@ietf.org; Sat, 11 Aug 2007 09:47:42 -0400 Received: from rufus.isode.com ([62.3.217.251]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IJrJd-0007rB-Nz for kitten@ietf.org; Sat, 11 Aug 2007 09:47:41 -0400 Received: from [172.16.1.99] (shiny.isode.com [62.3.217.250]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Sat, 11 Aug 2007 14:47:39 +0100 Message-ID: <46BDBE34.60704@isode.com> Date: Sat, 11 Aug 2007 14:48:36 +0100 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 X-Accept-Language: en-us, en To: kitten@ietf.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 2870a44b67ee17965ce5ad0177e150f4 Cc: Subject: Minutes for Kitten WG session in Chicago X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kitten-bounces@lists.ietf.org Chairs uploaded the minutes, but forgot to post information to the mailing list. So please send any comments: _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@lists.ietf.org Wed Aug 15 16:21:06 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1ILPKx-0006yM-ET; Wed, 15 Aug 2007 16:19:27 -0400 Received: from kitten by megatron.ietf.org with local (Exim 4.43) id 1ILPKv-0006x0-Uv for kitten-confirm+ok@megatron.ietf.org; Wed, 15 Aug 2007 16:19:26 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1ILPKv-0006wr-K3 for kitten@lists.ietf.org; Wed, 15 Aug 2007 16:19:25 -0400 Received: from www.ioplex.com ([64.22.109.41] helo=mail.ioplex.com) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1ILPKh-0000BD-EB for kitten@lists.ietf.org; Wed, 15 Aug 2007 16:19:25 -0400 Received: from quark.foo.net (c-69-142-196-170.hsd1.nj.comcast.net [69.142.196.170]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: miallen) by mail.ioplex.com (Postfix) with ESMTP id ABD424069D; Wed, 15 Aug 2007 16:19:07 -0400 (EDT) Date: Wed, 15 Aug 2007 16:19:06 -0400 From: Michael B Allen To: "Henry B. Hotz" Message-Id: <20070815161906.8fcc2ddf.miallen@ioplex.com> In-Reply-To: <540F131A-18D4-4343-AE0F-3B5D760DA215@jpl.nasa.gov> References: <540F131A-18D4-4343-AE0F-3B5D760DA215@jpl.nasa.gov> Organization: IOPLEX Software X-Mailer: Sylpheed 2.4.0 (GTK+ 2.10.4; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Score: 0.0 (/) X-Scan-Signature: 69a74e02bbee44ab4f8eafdbcedd94a1 Cc: Alf Wachsmann , heimdal-discuss@sics.se, kitten@lists.ietf.org Subject: Re: MEMORY credential cache interop between Heimdal and MIT? X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kitten-bounces@lists.ietf.org [I'm CC'ing kitten because I think this is probably the #2 issue with GSSAPI for me.] On Wed, 15 Aug 2007 12:16:53 -0700 "Henry B. Hotz" wrote: > > Is there a way to make the MEMORY credential cache work in such a > > mixed Heimdal/MIT setting? > > > > Many thanks, > > I seriously doubt it, but if someone can say how I'd be really > interested. The memory ccache is hanging off of a private symbol called mkt_head which is specific to the Heimdal libraries. No doubt MIT's has something similar but neither library has access to the others memory keytab chain. This is actually a fundamental problem with authentication mechanisms in general. It get's into the issue of how to manage credentials. Currently Kerberos uses disk files. That is clumsy and in some cases downright insecure. I have personally concluded that the proper solution is for the OS to provide a secure storage mechanism where a library can put arbitrary data that can by accessed using a key such as a simple number or preferably a string (e.g. 'krb5:MEMORY:') that may be accessed ONLY by the same pid or by a descendant (i.e. the storage is inherited). I'm not sure if this can be done entirely in userspace but if it could that would be an interesting project. Then you could have MEMORY: ccache and keytab interoperability and get around a lot of ugly environment variable / file hacks. Mike -- Michael B Allen PHP Active Directory Kerberos SSO http://www.ioplex.com/ _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten From kitten-bounces@lists.ietf.org Wed Aug 22 09:29:56 2007 Return-path: Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1INqFl-0004GM-1f; Wed, 22 Aug 2007 09:28:09 -0400 Received: from kitten by megatron.ietf.org with local (Exim 4.43) id 1INqFj-0004FE-5t for kitten-confirm+ok@megatron.ietf.org; Wed, 22 Aug 2007 09:28:07 -0400 Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1INqFi-0004F5-S0 for kitten@lists.ietf.org; Wed, 22 Aug 2007 09:28:06 -0400 Received: from smtp3.su.se ([130.237.93.228]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1INqFg-0003CE-Of for kitten@lists.ietf.org; Wed, 22 Aug 2007 09:28:06 -0400 Received: from localhost (localhost [127.0.0.1]) by smtp3.su.se (Postfix) with ESMTP id C83473BF89; Wed, 22 Aug 2007 15:27:59 +0200 (CEST) Received: from smtp3.su.se ([127.0.0.1]) by localhost (smtp3.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 10302-01-100; Wed, 22 Aug 2007 15:27:59 +0200 (CEST) Received: from [130.237.95.248] (it-vista01.it.su.se [130.237.95.248]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp3.su.se (Postfix) with ESMTP id 863713BE2B; Wed, 22 Aug 2007 15:27:59 +0200 (CEST) Message-ID: <46CC39F3.3000506@it.su.se> Date: Wed, 22 Aug 2007 15:28:19 +0200 From: Leif Johansson User-Agent: Thunderbird 1.5.0.12 (X11/20070604) MIME-Version: 1.0 To: Heimdal-discuss list , ietf-krb-wg@anl.gov, kitten@lists.ietf.org X-Enigmail-Version: 0.94.2.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at smtp.su.se X-Spam-Status: No, hits=-1.891 tagged_above=-99 required=7 tests=[AWL=0.421, BAYES_00=-2.312] X-Spam-Level: X-Spam-Score: -4.0 (----) X-Scan-Signature: 1ac7cc0a4cd376402b85bc1961a86ac2 Cc: Subject: Enter the kaml. X-BeenThere: kitten@lists.ietf.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kitten-bounces@lists.ietf.org There was a bar-BOF at the Chicago IETF about possible intersections between Kerberos and SAML. At the meeting it was decided to try to gather around a mailinglist: kaml@ietf.org with the added ambition to figure out if there is enough interest to request a proper BOF. The list is now active. Either send an email to kaml-request@ietf.org with the word "subscribe" here and there or go to http://www1.ietf.org/mailman/listinfo/kaml and fill out the subscription form. Cheers Leif _______________________________________________ Kitten mailing list Kitten@lists.ietf.org https://www1.ietf.org/mailman/listinfo/kitten