Subject: Re: hostbased service names (or not)

From: Jeffrey Altman <[email-masked]>
Date: Fri, 28 Apr 2000 14:19:41 EDT

> Which credentials can be our should be shared is extremely dependent
> on the capabilities of the gssapi mechanism as well as the habits
> and policies of the system administration.  The application should
> neither make assumptions nor set requirements in this area, because
> that will definitely reduce the portability across gssapi mechanisms
> and computing environments.
> 

so really we disagree on whether or not System Administrators should 
be allowed to set policy via the applications as opposed to the GSSAPI
mechansim.  Since the GSSAPI mechanism may not allow policy to be set
the application should be able to enforce the policy of the system
administration.  

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Martin Rex <[email-masked]>
Date: Fri, 28 Apr 2000 21:15:47 +0200 (METDST)

> the application should be able to enforce the policy of the system

No.

Your posistion:
  applications should enforce architecture and policies on sysadmins
  and gssapi mechanisms by requiring hostbased services names to work.

My posistion:
  gssapi mechanisms should be configurable for sharing credentials
  of services, and applications should be configurable for credentials
  and target names, so that the sysadmin and the users may freely
  choose among available gssapi mechanisms and determine their own
  policies (on sharing certain services credentials).

-Martin

---

From: "Theodore Ts'o" <[email-masked]>
Date: Sat, 29 Apr 2000 02:37:45 -0400

From: Martin Rex <[email-masked]>
   Date: Fri, 28 Apr 2000 21:15:47 +0200 (METDST)

   Your posistion:
     applications should enforce architecture and policies on sysadmins
     and gssapi mechanisms by requiring hostbased services names to
     work.

Well, my position is this: host-based service names should work so that
the mapping between host/service pairs and mechanism names is done in
one place --- at the mechanism layer, utilizing some kind of
implementation specific database mapping layer which can be configurable
by users and sysadmins for their particular site.  

This is absolutely necessary for simple GSSPAI mechanism negotiation to
work, as I mentioned earlier.  It also concentrates the work necessary
at the low-level mechanism level, so it only needs to be implemented
once per mechanism, instead once for every GSSAPI application.

						- Ted