From mailman-bounces@core3.amsl.com Fri Feb 1 06:23:57 2008 Return-Path: X-Original-To: ietfarch-kitten-archive@core3.amsl.com Delivered-To: ietfarch-kitten-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 90ADD294BE8 for ; Fri, 1 Feb 2008 06:23:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.588 X-Spam-Level: X-Spam-Status: No, score=-2.588 tagged_above=-999 required=5 tests=[AWL=0.011, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NlMROOhxIu77 for ; Fri, 1 Feb 2008 06:23:29 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F34FC29504F for ; Fri, 1 Feb 2008 05:59:59 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: kitten-archive@megatron.ietf.org X-No-Archive: yes Message-ID: Date: Fri, 01 Feb 2008 05:07:32 -0800 Precedence: bulk X-BeenThere: mailman@core3.amsl.com X-Mailman-Version: 2.1.9 List-Id: X-List-Administrivia: yes Sender: mailman-bounces@core3.amsl.com Errors-To: mailman-bounces@core3.amsl.com This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. If you have questions, problems, comments, etc, send them to mailman-owner@ietf.org. Thanks! http://www.ietf.org/mailman/options/kitten/kitten-archive%40megatron.ietf.org From mailman-bounces@core3.amsl.com Fri Feb 1 06:27:00 2008 Return-Path: X-Original-To: ietfarch-kitten-archive@core3.amsl.com Delivered-To: ietfarch-kitten-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E08928DB7F for ; Fri, 1 Feb 2008 06:26:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.588 X-Spam-Level: X-Spam-Status: No, score=-2.588 tagged_above=-999 required=5 tests=[AWL=0.011, BAYES_00=-2.599] Received: from core3.amsl.com ([127.0.0.1]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2cO9FdI0HkKu for ; Fri, 1 Feb 2008 06:26:51 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA42428D229 for ; Fri, 1 Feb 2008 05:59:43 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Subject: ietf.org mailing list memberships reminder From: mailman-owner@ietf.org To: kitten-archive@megatron.ietf.org X-No-Archive: yes Message-ID: Date: Fri, 01 Feb 2008 05:07:30 -0800 Precedence: bulk X-BeenThere: mailman@core3.amsl.com X-Mailman-Version: 2.1.9 List-Id: X-List-Administrivia: yes Sender: mailman-bounces@core3.amsl.com Errors-To: mailman-bounces@core3.amsl.com This is a reminder, sent out once a month, about your ietf.org mailing list memberships. It includes your subscription info and how to use it to change it or unsubscribe from a list. You can visit the URLs to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on. In addition to the URL interfaces, you can also use email to make such changes. For more info, send a message to the '-request' address of the list (for example, mailman-request@ietf.org) containing just the word 'help' in the message body, and an email message will be sent to you with instructions. If you have questions, problems, comments, etc, send them to mailman-owner@ietf.org. Thanks! http://www.ietf.org/mailman/options/kitten/kitten-archive%40megatron.ietf.org From kitten-bounces@ietf.org Thu Feb 7 10:27:00 2008 Return-Path: X-Original-To: ietfarch-kitten-archive@core3.amsl.com Delivered-To: ietfarch-kitten-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CA4893A799B; Thu, 7 Feb 2008 10:27:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.877 X-Spam-Level: X-Spam-Status: No, score=-5.877 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_MED=-4] Received: from core3.amsl.com ([127.0.0.1]) by localhost (mail.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id peD5u+yxq5Hl; Thu, 7 Feb 2008 10:26:59 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DB7A53A76B7; Thu, 7 Feb 2008 10:26:59 -0800 (PST) X-Original-To: kitten@core3.amsl.com Delivered-To: kitten@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B8073A76B7 for ; Thu, 7 Feb 2008 10:26:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from core3.amsl.com ([127.0.0.1]) by localhost (mail.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JmPx7A1LoEhI for ; Thu, 7 Feb 2008 10:26:57 -0800 (PST) Received: from smtpde01.sap-ag.de (smtpde01.sap-ag.de [155.56.68.171]) by core3.amsl.com (Postfix) with ESMTP id 273D03A72C2 for ; Thu, 7 Feb 2008 10:26:48 -0800 (PST) Received: from mail.sap.corp by smtpde01.sap-ag.de (26) with ESMTP id m17IRsQ7029759; Thu, 7 Feb 2008 19:27:55 +0100 (MET) From: Martin Rex Message-Id: <200802071827.m17IRkw3004996@fs4113.wdf.sap.corp> Subject: Re: [Ietf-krb-wg] the PKU2U DN to Kerberos Principal name mapping To: jhutz@cmu.edu (Jeffrey Hutzelman) Date: Thu, 7 Feb 2008 19:27:46 +0100 (MET) In-Reply-To: from "Jeffrey Hutzelman" at Jan 29, 8 12:42:35 pm MIME-Version: 1.0 X-Scanner: Virus Scanner virwal05 X-SAP: out Cc: kitten@ietf.org, hotz@jpl.nasa.gov, Nicolas.Williams@sun.com, jhutz@cmu.edu X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: martin.rex@sap.com List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org Jeffrey Hutzelman wrote: > > --On Monday, January 28, 2008 05:55:04 PM -0600 Nicolas Williams > wrote: > > > I'm not sure that we actually want GSS_Compare_name() to sport such > > behaviour, as opposed to having a new function that does, because it's > > pushing things a bit to say that the two NAME objects passed to it are > > equal representations of the same principal. They are representations > > of the same principal name, just not _equal_ representations of it. > > That's OK. GSS_Compare_name is defined to return a true result when the > names represent the same entity, not only when they are the same. This > appears to be exactly what GSS_Compare_name is for, so no, I don't think we > need a new interface for this. Personally, I would prefer to see a new API instead of seeing an existing API being frobbed in such new ways. A possibility to extract all sorts of attributes from Certificates besides the Subject DName (and in particular for Kerberos mechanisms) is extremely non-portable and may often not even locally work in a (application-provider) predictable fashion. Example: although the nametypes User Name Form (GSS_C_NT_USER_NAME) and Machine UID Form (GSS_C_NT_MACHINE_UID_NAME) are specified at the generic level (rfc2743), the translation of any such name into an authenticated identity is fairly unspecified, and not just implementation defined, but in addition may depend on local configuration. In MIT Kerberos, there might be a "tradition" (resulting in some level of expectation) that a username or uid is mapped to a Kerberos principal name by appending some realm name, but from the GSS-API perspective, it would be ok if acquisition of credentials for an "OS username" or and "OS userid" would resolve to the "default" credentials of that user. Depending on whether the current process is running as the specified user or for someone else the name translation outcome may differ or even fail. IIRC, DCE allowed an explicit mapping table between the DCE principal name and a local account name, and Microsoft W2K workstations joined to a vanilla Kerberos KDC also allow/require an explicit local mapping between local accounts and Kerberos principals from vanilla Kerberos KDCs. With new, explicit API calls it is much easier to define how any fancy new name translation functionality can be made to work in a fashion that is portable/predictable accross different independent implementations of a gssapi mechanism, and to distinguish gssapi implementations that support this extensions and those that don't. -Martin _______________________________________________ Kitten mailing list Kitten@ietf.org http://www.ietf.org/mailman/listinfo/kitten From kitten-bounces@ietf.org Fri Feb 29 22:23:32 2008 Return-Path: X-Original-To: ietfarch-kitten-archive@core3.amsl.com Delivered-To: ietfarch-kitten-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 769D43A6DE2; Fri, 29 Feb 2008 22:23:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.089 X-Spam-Level: X-Spam-Status: No, score=-1.089 tagged_above=-999 required=5 tests=[AWL=-0.652, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LEATGcCkWIV6; Fri, 29 Feb 2008 22:23:27 -0800 (PST) Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D68E3A6DC2; Fri, 29 Feb 2008 22:23:27 -0800 (PST) X-Original-To: kitten@core3.amsl.com Delivered-To: kitten@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 851FA3A6B0C for ; Fri, 29 Feb 2008 22:23:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yoHNIBqfq6-I for ; Fri, 29 Feb 2008 22:23:21 -0800 (PST) Received: from brmea-mail-3.sun.com (brmea-mail-3.Sun.COM [192.18.98.34]) by core3.amsl.com (Postfix) with ESMTP id 648233A6783 for ; Fri, 29 Feb 2008 22:22:19 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m216MARR015711 for ; Sat, 1 Mar 2008 06:22:10 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0JX100101G46GP00@mail-amer.sun.com> (original mail from Shawn.Emery@Sun.COM) for kitten@ietf.org; Fri, 29 Feb 2008 23:22:10 -0700 (MST) Received: from [10.0.0.5] ([206.124.7.73]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0JX100D82GCYMN60@mail-amer.sun.com> for kitten@ietf.org; Fri, 29 Feb 2008 23:22:10 -0700 (MST) Date: Fri, 29 Feb 2008 23:23:43 -0700 From: Shawn M Emery Subject: IETF 71 Agenda To: kitten@ietf.org Message-id: <47C8F66F.40104@sun.com> MIME-version: 1.0 User-Agent: Thunderbird 2.0.0.9 (X11/20071119) X-BeenThere: kitten@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Common Authentication Technologies - Next Generation List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: kitten-bounces@ietf.org Errors-To: kitten-bounces@ietf.org Please review the meeting agenda for IETF 71: http://www.ietf.org/proceedings/08mar/agenda/kitten.txt and let us know if you would like to add or change anything. Shawn. -- _______________________________________________ Kitten mailing list Kitten@ietf.org https://www.ietf.org/mailman/listinfo/kitten