Subject: Re: SASL GSSAPI draft

From: [email-masked] (John Myers)
Date: Tue, 06 Jun 2000 15:54:38 -0700

Ken Hornstein wrote:
> Okay, I saw only a message from Bill Ricker asking about SPNEGO,
> posting by you, and Paul Leach's reply.

I recall some other exchange when I first published a draft, but haven't
located it.  It doesn't much matter, we're having a good discussion
about this now.

> Having said that .... I
> think that a client that sent a SPNEGO token to a SPNEGO-unaware
> server would fail.  I have been thinking for a while on how to
> migrate to clients & servers supporting SPNEGO, and I haven't come
> up with any good ideas yet (if I'm missing something obvious, then
> please let me know).

I don't think you can make this work and maintain SPNEGO's security
requirement to protect the negotiation of mechanism.  A man in the
middle could make it appear to each side that the other does not support
SPNEGO, thus forcing a downgrade to the weakest mechanism.

If you are willing to take this risk, forgoing this property of SPNEGO,
then the propsal to negoitate the mechanism directly through SASL
instead of through SPNEGO is simpler.

> This presumes that the app will have to have special-case code to
> determine which mechanisms exist and to apply policy information
> to the mechanism list; I'm not sure how you'll do that without
> giving the app knowledge of each mechanism, which would kinda defeat
> part of the purpose of GSSAPI.  I have a hard time imaging this done
> in practice (it seems that you can give SPNEGO some policy constraints,
> but it doesn't give you the ability to do the ordering you want).

Typically, a SASL library has both policy constrants and a mechanism
preference ordering.  Usually the preferences are ordered from strongest
mechanism to weakest, but sometimes the cost of obtaining a credential
affects this.  For example, if the SASL library has a Kerberos
credential available, it may want to use Kerberos over any mechanism
that will need to prompt the user.

---

From: [email-masked] (John Myers)
Date: Wed, 14 Jun 2000 23:32:46 -0700

Ken Hornstein wrote:
> As I read RFC 2478,
> you always deal with the OID of the underlying mechanism, so I
> don't think it's possible to support, for example, Kerberos "under"
> SPNEGO without just supporting Kerberos

If a server supports Kerberos underneath SPNEGO but rejects Kerberos
GSSAPI tokens not underneath SPNEGO, which requirement of RFC 2478 is
that server violating?