IETF Logo Mail Archive

Re: [Ietf-krb-wg] AD review of draft-ietf-krb-wg-kerberos-referrals-14

Nico Williams <nico@cryptonector.com> Fri, 14 September 2012 18:48 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Delivered-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B191321F853B for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Fri, 14 Sep 2012 11:48:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.068
X-Spam-Level:
X-Spam-Status: No, score=-4.068 tagged_above=-999 required=5 tests=[AWL=1.909, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MRT935HC3q+M for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Fri, 14 Sep 2012 11:48:25 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by ietfa.amsl.com (Postfix) with ESMTP id 0B71921F84F8 for <krb-wg-archive@lists.ietf.org>; Fri, 14 Sep 2012 11:48:25 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id 55FEED6F; Fri, 14 Sep 2012 13:48:24 -0500 (CDT)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id DF00D29; Fri, 14 Sep 2012 13:48:23 -0500 (CDT)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 9EBA054C006; Fri, 14 Sep 2012 13:48:23 -0500 (CDT)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by lists.anl.gov (Postfix) with ESMTP id 9D8CC8104B for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 13:48:22 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id 856917CC124; Fri, 14 Sep 2012 13:48:22 -0500 (CDT)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10776-06; Fri, 14 Sep 2012 13:48:22 -0500 (CDT)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay.anl.gov (Postfix) with ESMTP id 5EBBF7CC087 for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 13:48:22 -0500 (CDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: ApsBABV7U1DQYYSxjmdsb2JhbABFDoV5tXMqAQEBAQkLCQkSBSSCIAEBAQECARICDx05AQ8LCw0CAiYCAiISAQUBHAYTIodlBp0CCQOKaG6DSI87BoEhiXQkhTKBEohZjQuOQhYpg0xY
X-IronPort-AV: E=Sophos;i="4.80,423,1344229200"; d="scan'208";a="1820152"
Received: from caiajhbdcbhh.dreamhost.com (HELO homiemail-a64.g.dreamhost.com) ([208.97.132.177]) by mailgateway.anl.gov with ESMTP; 14 Sep 2012 13:48:21 -0500
Received: from homiemail-a64.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a64.g.dreamhost.com (Postfix) with ESMTP id 192BD438080 for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 11:48:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=SPzY1GaOO0vPnJMMAchT rCVV/04=; b=M95/AUvu4+aGEK/Zgp8/5w8lDM3ZCeK74K96+b+sY3uY5s114Vj5 rzVpZ8WbSSxKV6XiyrkV9wEh/Ep0PaswApgf+LeIITLqx++KYg5LUcHllDeZCleA KZJxuWrC9xEXR3FCAzYR8jH5Lc0pCPMnSxXUueOur2XY/W7PWa3xCGA=
Received: from mail-pz0-f47.google.com (mail-pz0-f47.google.com [209.85.210.47]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a64.g.dreamhost.com (Postfix) with ESMTPSA id F2AD443807C for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 11:48:20 -0700 (PDT)
Received: by daks35 with SMTP id s35so2588219dak.20 for <ietf-krb-wg@lists.anl.gov>; Fri, 14 Sep 2012 11:48:20 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.224.73 with SMTP id ra9mr6118862pbc.85.1347648500675; Fri, 14 Sep 2012 11:48:20 -0700 (PDT)
Received: by 10.68.20.194 with HTTP; Fri, 14 Sep 2012 11:48:20 -0700 (PDT)
In-Reply-To: <tslpq5o1nr0.fsf@mit.edu>
References: <50512CF2.6090801@cs.tcd.ie> <tslobl84m2q.fsf@mit.edu> <CAK3OfOjJu0_nMN3tqXY_V34daC3iPraW_5oR9bkV5=fB_AN4xg@mail.gmail.com> <tslpq5o1nr0.fsf@mit.edu>
Date: Fri, 14 Sep 2012 13:48:20 -0500
Message-ID: <CAK3OfOjzMxjLEH0dbtgPDudamM9hpDGV8hgEha=taMP1dQmi=w@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Sam Hartman <hartmans-ietf@mit.edu>
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Cc: "krb-wg mailing list (ietf-krb-wg@lists.anl.gov)" <ietf-krb-wg@lists.anl.gov>
Subject: Re: [Ietf-krb-wg] AD review of draft-ietf-krb-wg-kerberos-referrals-14
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ietf-krb-wg-bounces@lists.anl.gov
Sender: ietf-krb-wg-bounces@lists.anl.gov

On Fri, Sep 14, 2012 at 1:08 PM, Sam Hartman <hartmans-ietf@mit.edu> wrote:
>     Nico> Actually, AD does support varying levels of trust within
>     Nico> forests.  An AD client could search the AD configuration
>     Nico> partition to decide whether some realm is trusted or not, but
>     Nico> this is hard work.
>
> Sorry, clients accept the referral if they can get their own host ticket
> and verify it.

Sure.  I think we both meant to say different things.  AD can
represent less than full trust between all realms in a forest, but
clients accept referrals to anywhere within the forest.  Clients check
nothing more than the referred-to realm being within the forest -- the
KDC could not have issued the ticket if the referred-to realm did not
trust the client's realm and that's that.  Yes?

>     >> The intent of that paragraph if is that if you're going outside
>     >> of an AD-style trust model you may need to prompt.
>
>     Nico> Then it seems like we need an RFC2119 SHOULD.
>
> We're debating whether the SHOULD can be implemented.
>
> As stated, you should check policy.  I personally think you eventually
> get to a point where you have to check by asking the user, but I
> certainly don't want to SHOULD that specific way of checking.  If you
> find something environment-specific that works better, that's great.

OK, I see.  Prompting is hard because of the interfaces involved...

Nico
--
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email