Re: [kitten] Clarification of gss_add_cred() behavior

[Benjamin Kaduk <[e-mail]>]

On Wed, 18 Mar 2015, Nico Williams wrote:

> I need a clarification of RFCs 2743 and 2744 as to GSS_add_cred().
>
>     Is it really the case that calling GSS_Add_cred() with no
>     input_cred_handle (GSS_C_NO_CREDENTIAL) must ignore desired_name
>     even when it is not the GSS_C_NO_NAME??
>
> I think the answer is that this text in RFC2743 section 2.1.4, page 39:
>
>    If GSS_C_NO_CREDENTIAL is specified as input_cred_handle, a non-NULL
>    output_cred_handle must be supplied.  For the case of
>    GSS_C_NO_CREDENTIAL as input_cred_handle, GSS_Add_cred() will create
>    the credential referenced by its output_cred_handle based on default
>    behavior.  That is, the call will have the same effect as if the
>    caller had previously called GSS_Acquire_cred(), specifying the same
>    usage and passing GSS_C_NO_NAME as the desired_name parameter
>    (thereby obtaining an explicit credential handle corresponding to
>    default behavior), had passed that credential handle to
>    GSS_Add_cred(), and had finally called GSS_Release_cred() on the
>    credential handle received from GSS_Acquire_cred().
>
> and the corresponding and matching text in RFC2744 section 5.3, are
> subtly wrong.  This text should have read thusly:
>
>    If GSS_C_NO_CREDENTIAL is specified as input_cred_handle, a non-NULL
>    output_cred_handle must be supplied.  For the case of
>    GSS_C_NO_CREDENTIAL as input_cred_handle and desired_name as
>    GSS_C_NO_NAME, GSS_Add_cred() will create
>    the credential referenced by its output_cred_handle based on default
>    behavior.  ...
>
> That is, it should be possible to call GSS_Add_cred() with
> input_cred_handle == GSS_C_NO_CREDENTIAL and a
> desired_name != GSS_C_NO_NAME, and get a CREDENTIAL HANDLE for that
> desired_name.
>
> Otherwise GSS_Add_cred() is mostly useless.
>
> I think this must have been a drafting error.  It's obvious to me, but
> maybe someone has a very different opinion as to this (Martin?).

But a GSS credential can only represent a single identity ("entity", see
1.1.1.1)!  Identities are represented by (non-mechanism) names, so it is
not clear to me that this is a drafting error.  If you know what name you
want credentials for, you should use it.

-Ben