Subject: Re: LIKPEY issues (was Re: host based principal names)

From: Jeffrey Altman <[email-masked]>
Date: Tue, 25 Apr 2000 14:22:46 EDT

> What I'd like to see in the rfc1964 successor is either a definition
> for this mapping or a clear reference of such a mapping in another RFC
> (e.g. rfc1510bis).  In particular, I'd like to see whether any service
> names must or must not be transformed into the "host" principal.

I think you confusing things.  The GSS-API does not perform any
mapping from 

  [email-masked]

to

  host/[email-masked]

when using Kerberos V.

When the GSSAPI-Kerberos_V FTP client creates a security context it
first calls gss_ini_sec_context() with the result of calling 
gss_import_name() with the string "[email-masked]".  If the
authentication fails, it then silently tries again with
"[email-masked]".  There is no mapping within the GSSAPI implementation
from "ftp" to "host".  This is simply part of the specification for
how GSSAPI is used with a specific application level protocol (such as
FTP.)

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Martin Rex <[email-masked]>
Date: Tue, 25 Apr 2000 20:38:57 +0200 (METDST)

>   host/[email-masked]

That is exactly what I am complaining about!

If you insist on using a "portable" hostbased service name for applications,
then I insist on using A SINGLE one.

I.e. I want to require that
    telnet via GSS-API always use exactly "[email-masked]",
    rlogin via GSS-API always use exactly "[email-masked]",
    ftp via GSS-API always use exactly "[email-masked]",
    nfs via GSS-API always use exactly "[email-masked]"

No alternate trying of "[email-masked]" permitted for the application
(because this is a Kerberos mechanism-specific thingy).

If Kerberos wants to share the host/f.q.d.n for several services,
then it is up to the Kerberos GSS-API mechanism spec to define
exactly how an when "[email-masked]", "[email-masked]", "[email-masked]",
etc. are internally transformed into "host/f.q.d.n".

> how GSSAPI is used with a specific application level protocol (such as

This is exactly broken application behaviour to work around defects
in the Kerberos GSS-API spec.  Yuck!

-Martin

---

From: Ken Hornstein <[email-masked]>
Date: Tue, 25 Apr 2000 15:24:07 -0400

>(because this is a Kerberos mechanism-specific thingy).

And the reason these various protocols can't all share a single "host"
service name is ... ? (okay, for ftp it's already too late, and nfs has
already been decided, but I don't see why telnet and rlogin can't simply
be specified to both use "host").

>in the Kerberos GSS-API spec.  Yuck!

I think I'm with others on this one: it's a little late to complain about
this aspect of GSSAPI authentication inside of ftp now.

--Ken

---

From: Mike Eisler <[email-masked]>
Date: Tue, 25 Apr 2000 14:08:12 -0700 (PDT)

> (because this is a Kerberos mechanism-specific thingy).

Applications should be free to specify the name of principal used for the
target. As an application writer you are free to use host@fqdn or <foo>@fqdn
for your own applications. However, for better or worse, ftp and nfs do not
require the use use of host@, and in the case of nfs, do not allow the use of
host@. And there are RFCs for each that say that. I don't know what the
treatment is for ldap, the dns transfer service, or anything else that uses
GSS-API.

I don't see that the inconsistency in target names among applications is much
of an inconvenience. Each application protocol is unique, and the name used
for the target is yet another aspect of the uniqueness. What would
be extremely inconvient would be if each applciation/mechanism
pair used a unique GSS-API name type.

	-mre