Subject: [abfab] Representation of names without realm

From: Sam Hartman <[email-masked]>
Date: Fri, 18 Mar 2011 06:57:45 -0400

Currently if you have a ABFAB name with no realm it looks lie "foo" or
"foo/bar.example.com" not "foo@".

For one use (sending the EAP identity response) this is clearly correct.

Howere this forbids realm defaulting within the acceptor and the
initiator.
The AAA infrastructure can still do realm defaulting if it likes, but
the GSS code cannot distinguish cases where the realm was intended to be
defaulted from cases where the realm was intended to be left to AAA.

So long as there are no cases where we hope the GSS infrastructure fills
in a default this is fine.

I think the current behavior is OK, but want to check with the WG.

--Sam

---

From: Nico Williams <[email-masked]>
Date: Fri, 18 Mar 2011 06:31:30 -0500

It'd be OK for canonicalized names (MNs) to have or not have realm name
components.  However, you might want syntax via which users can specify
realm-less-ness [when importing name strings].  Alternatively you could use
additional name types for conveying this one bit of information.

Nico
--