IETF Logo Mail Archive

Re: [Ietf-krb-wg] AD review of draft-ietf-krb-wg-kerberos-referrals-14

Sam Hartman <hartmans-ietf@mit.edu> Fri, 14 September 2012 19:19 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Delivered-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C7E121F84AF for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Fri, 14 Sep 2012 12:19:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -104.111
X-Spam-Level:
X-Spam-Status: No, score=-104.111 tagged_above=-999 required=5 tests=[AWL=2.488, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NZjHal7eUqzO for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Fri, 14 Sep 2012 12:19:08 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by ietfa.amsl.com (Postfix) with ESMTP id 9D04221F844B for <krb-wg-archive@lists.ietf.org>; Fri, 14 Sep 2012 12:19:08 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 92D2C1AA7; Fri, 14 Sep 2012 14:19:06 -0500 (CDT)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id 198E51AB8; Fri, 14 Sep 2012 14:19:02 -0500 (CDT)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id D1D428104F; Fri, 14 Sep 2012 14:19:01 -0500 (CDT)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by lists.anl.gov (Postfix) with ESMTP id 60A6A8104B for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 14:19:00 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id 4ABEB7CC0B5; Fri, 14 Sep 2012 14:19:00 -0500 (CDT)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 23265-09; Fri, 14 Sep 2012 14:19:00 -0500 (CDT)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay.anl.gov (Postfix) with ESMTP id 3086C7CC097 for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 14:19:00 -0500 (CDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Au8GAF2CU1AXFeNd/2dsb2JhbABFgkS5RoEHgiEBBQ8BKj8QCyElDwEEGDETiA2neAGKcokHix8khkQDpgKDAg
X-IronPort-AV: E=Sophos;i="4.80,424,1344229200"; d="scan'208";a="1822692"
Received: from ec2-23-21-227-93.compute-1.amazonaws.com ([23.21.227.93]) by mailgateway.anl.gov with ESMTP/TLS/ADH-AES256-SHA; 14 Sep 2012 14:18:59 -0500
Received: from carter-zimmerman.suchdamage.org (c-98-217-126-210.hsd1.ma.comcast.net [98.217.126.210]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "laptop", Issuer "laptop" (not verified)) by mail.suchdamage.org (Postfix) with ESMTPS id 975BC2010D; Fri, 14 Sep 2012 15:18:50 -0400 (EDT)
Received: by carter-zimmerman.suchdamage.org (Postfix, from userid 8042) id CB1E14149; Fri, 14 Sep 2012 15:18:39 -0400 (EDT)
From: Sam Hartman <hartmans-ietf@mit.edu>
To: Nico Williams <nico@cryptonector.com>
References: <50512CF2.6090801@cs.tcd.ie> <tslobl84m2q.fsf@mit.edu> <CAK3OfOjJu0_nMN3tqXY_V34daC3iPraW_5oR9bkV5=fB_AN4xg@mail.gmail.com> <tslpq5o1nr0.fsf@mit.edu> <CAK3OfOjzMxjLEH0dbtgPDudamM9hpDGV8hgEha=taMP1dQmi=w@mail.gmail.com>
Date: Fri, 14 Sep 2012 15:18:39 -0400
In-Reply-To: <CAK3OfOjzMxjLEH0dbtgPDudamM9hpDGV8hgEha=taMP1dQmi=w@mail.gmail.com> (Nico Williams's message of "Fri, 14 Sep 2012 13:48:20 -0500")
Message-ID: <tslboh81khc.fsf@mit.edu>
User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/22.3 (gnu/linux)
MIME-Version: 1.0
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Cc: "krb-wg mailing list (ietf-krb-wg@lists.anl.gov)" <ietf-krb-wg@lists.anl.gov>, Sam Hartman <hartmans-ietf@MIT.EDU>
Subject: Re: [Ietf-krb-wg] AD review of draft-ietf-krb-wg-kerberos-referrals-14
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ietf-krb-wg-bounces@lists.anl.gov
Sender: ietf-krb-wg-bounces@lists.anl.gov

>>>>> "Nico" == Nico Williams <nico@cryptonector.com> writes:

    Nico> On Fri, Sep 14, 2012 at 1:08 PM, Sam Hartman <hartmans-ietf@mit.edu> wrote:
    Nico> Actually, AD does support varying levels of trust within
    Nico> forests.  An AD client could search the AD configuration
    Nico> partition to decide whether some realm is trusted or not, but
    Nico> this is hard work.
    >> 
    >> Sorry, clients accept the referral if they can get their own host
    >> ticket and verify it.

    Nico> Sure.  I think we both meant to say different things.  AD can
    Nico> represent less than full trust between all realms in a forest,
    Nico> but clients accept referrals to anywhere within the forest.
    Nico> Clients check nothing more than the referred-to realm being
    Nico> within the forest -- the KDC could not have issued the ticket
    Nico> if the referred-to realm did not trust the client's realm and
    Nico> that's that.  Yes?

Since a forest can have one-way trusts I think it means more than within
forest.
But I think we're well beyond what's needed for this discussion.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email