Subject: Re: hostbased service names (or not)

From: Jeffrey Altman <[email-masked]>
Date: Fri, 28 Apr 2000 15:37:39 EDT

> Your posistion:
>   applications should enforce architecture and policies on sysadmins
>   and gssapi mechanisms by requiring hostbased services names to work.
> 
> My posistion:
>   gssapi mechanisms should be configurable for sharing credentials
>   of services, and applications should be configurable for credentials
>   and target names, so that the sysadmin and the users may freely
>   choose among available gssapi mechanisms and determine their own
>   policies (on sharing certain services credentials).

You are making a very bad assumption.  That GSSAPI is the only 
authentication mechanism available to the application.  Its not.
The application very frequently does have knowledge of policy that the
underlying authentication mechansims do not have. 

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]