[kitten] Authentication indicator - Do we need client indicator ?

[Simo Sorce <[e-mail]>]

Reading the draft I am wondering if we also need a "Client Indicator"
Auth Data definition (in this draft or a separate draft).

In AD-CAMMAC we mention that if the KDC want to make sure to bind the
CAMMAC to a specific client principal, then this need to be done with
data embedded into an AD within CAMMAC, but in AD-CAMMAC we specify no
AD type to do that.

I had not thought that we'd care about this binding in Auth Indicator
work, but I see S4U2Proxy is mentioned there, so perhaps we actually
do ?

Would it be bad to define a new AD-CLIENT-INDICATOR data type as part of
this RFC ?

The AD would be defined as:
 AD-CLIENT-INDICATOR ::= SEQUENCE {
	principal 	[0] PrincipalName
	realm		[1] Realm
}

The client indicator would be optional, but if it is included in a
CAMMAC the KDC MUST verify that the client in the ticket including the
CAMMAC matches the indicator.

The AD Auth indicator security considerations would mention that if
support for things like S4U2Proxy is desired and no other AD element in
the CAMMAC ties the CAMMAC to a specific principal, then
AD_CLIENT_INDICATOR SHOULD be used, and the KDC SHOULD deny a S4U2
operation (or perhaps simply omit the CAMMAC from the resulting ticket)
if AD-CLIENT-INDICATOR is missing.

Comments ?

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York