IETF Logo Mail Archive

Re: [Ietf-krb-wg] Review of draft-sorce-krbwg-general-pac-02

Nico Williams <nico@cryptonector.com> Tue, 05 July 2011 20:40 UTC

Return-Path: <ietf-krb-wg-bounces@lists.anl.gov>
X-Original-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Delivered-To: ietfarch-krb-wg-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F05421F892D for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Tue, 5 Jul 2011 13:40:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.747
X-Spam-Level:
X-Spam-Status: No, score=-4.747 tagged_above=-999 required=5 tests=[AWL=1.230, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jKr2cFT0kkRC for <ietfarch-krb-wg-archive@ietfa.amsl.com>; Tue, 5 Jul 2011 13:40:56 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by ietfa.amsl.com (Postfix) with ESMTP id 21B1121F891A for <krb-wg-archive@lists.ietf.org>; Tue, 5 Jul 2011 13:40:44 -0700 (PDT)
Received: from mailhost.anl.gov (mailhost.anl.gov [130.202.113.50]) by localhost.anl.gov (Postfix) with ESMTP id B7E0787; Tue, 5 Jul 2011 15:40:43 -0500 (CDT)
Received: from lists.anl.gov (katydid.it.anl.gov [146.137.96.32]) by mailhost.anl.gov (Postfix) with ESMTP id 8AC337C; Tue, 5 Jul 2011 15:40:43 -0500 (CDT)
Received: from katydid.it.anl.gov (localhost [127.0.0.1]) by lists.anl.gov (Postfix) with ESMTP id 7313580E9C; Tue, 5 Jul 2011 15:40:43 -0500 (CDT)
X-Original-To: ietf-krb-wg@lists.anl.gov
Delivered-To: ietf-krb-wg@lists.anl.gov
Received: from mailrelay.anl.gov (mailrelay.anl.gov [130.202.101.22]) by lists.anl.gov (Postfix) with ESMTP id 732BC80E88 for <ietf-krb-wg@lists.anl.gov>; Tue, 5 Jul 2011 15:40:41 -0500 (CDT)
Received: from localhost (localhost [127.0.0.1]) by localhost.it.anl.gov (Postfix) with ESMTP id 5D75F7CC09C; Tue, 5 Jul 2011 15:40:41 -0500 (CDT)
Received: from mailrelay.anl.gov ([127.0.0.1]) by localhost (mailrelay.anl.gov [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17465-05; Tue, 5 Jul 2011 15:40:41 -0500 (CDT)
Received: from mailgateway.anl.gov (mailgateway.anl.gov [130.202.101.28]) by mailrelay.anl.gov (Postfix) with ESMTP id 414247CC09A for <ietf-krb-wg@lists.anl.gov>; Tue, 5 Jul 2011 15:40:41 -0500 (CDT)
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhIBAAN2E07QYYRRkGdsb2JhbAAzChaEQqM/HAEBAQEJCQ0HFAMir0eLaIMQjV8BBIErg3+BDIdDineMIzyDdQ
X-IronPort-AV: E=Sophos;i="4.65,481,1304312400"; d="scan'208";a="62921724"
Received: from caiajhbdcaib.dreamhost.com (HELO homiemail-a72.g.dreamhost.com) ([208.97.132.81]) by mailgateway.anl.gov with ESMTP; 05 Jul 2011 15:40:40 -0500
Received: from homiemail-a72.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a72.g.dreamhost.com (Postfix) with ESMTP id 4949C6B0059 for <ietf-krb-wg@lists.anl.gov>; Tue, 5 Jul 2011 13:40:40 -0700 (PDT)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=cryptonector.com; h=mime-version :in-reply-to:references:date:message-id:subject:from:to:cc: content-type; q=dns; s=cryptonector.com; b=Epfabw6aHC3vF8lbtLQVh CW1syWtddiNVArg0Ql4RCzyczTAGDRoGGet7JIZAPuXEBKovaWN2xN8scTuHoKFw yELtHZ3WRoiW+Q8aVHSRwuWK1+SwbGYH83QaIR8YObdSAOcc5EgMz6kfSRowe5mi ubj91ISHH3mE0EPqICvNTc=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h= mime-version:in-reply-to:references:date:message-id:subject:from :to:cc:content-type; s=cryptonector.com; bh=15Am/SKxs1z5xHyrFXVd aMqKIhQ=; b=STTtyFPFWusKwf/NhdZATrzDPnWwypi16uGUbHCAdZjuIoGk5TGW QyPro9KjziA8bRcG9qgvMvWmLA2LEmyKEm4WhuVFQowNAGL8pqYXKFm7QyLK5jKv qSyGy3Mrxcb22jVcDZ5sYEZI+DSgNVf3CeIs6OXOnEadoAiQIo32Xn0=
Received: from mail-pz0-f47.google.com (mail-pz0-f47.google.com [209.85.210.47]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by homiemail-a72.g.dreamhost.com (Postfix) with ESMTPSA id 21F856B0014 for <ietf-krb-wg@lists.anl.gov>; Tue, 5 Jul 2011 13:40:40 -0700 (PDT)
Received: by pzk36 with SMTP id 36so4080522pzk.20 for <ietf-krb-wg@lists.anl.gov>; Tue, 05 Jul 2011 13:40:39 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.68.52.197 with SMTP id v5mr9406159pbo.387.1309898439676; Tue, 05 Jul 2011 13:40:39 -0700 (PDT)
Received: by 10.68.50.231 with HTTP; Tue, 5 Jul 2011 13:40:39 -0700 (PDT)
In-Reply-To: <CA265779.21018%josh.howlett@ja.net>
References: <AQHMMAyG4NotbIg08EaueELzIpiRbg==> <CA265779.21018%josh.howlett@ja.net>
Date: Tue, 05 Jul 2011 15:40:39 -0500
Message-ID: <CAK3OfOh16W2eRxaZPdEx2YUekjOGDFm+vDG62oAvhcT_-fMGmg@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Josh Howlett <Josh.Howlett@ja.net>
X-Virus-Scanned: Debian amavisd-new at frigga.it.anl.gov
Cc: "ietf-krb-wg@lists.anl.gov" <ietf-krb-wg@lists.anl.gov>
Subject: Re: [Ietf-krb-wg] Review of draft-sorce-krbwg-general-pac-02
X-BeenThere: ietf-krb-wg@lists.anl.gov
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: "This is a list for the IETF Kerberos Working Group. {WORLDPUB, EXTERNAL}" <ietf-krb-wg.lists.anl.gov>
List-Unsubscribe: <https://lists.anl.gov/mailman/options/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=unsubscribe>
List-Archive: <https://lists.anl.gov/pipermail/ietf-krb-wg>
List-Post: <mailto:ietf-krb-wg@lists.anl.gov>
List-Help: <mailto:ietf-krb-wg-request@lists.anl.gov?subject=help>
List-Subscribe: <https://lists.anl.gov/mailman/listinfo/ietf-krb-wg>, <mailto:ietf-krb-wg-request@lists.anl.gov?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: ietf-krb-wg-bounces@lists.anl.gov
Sender: ietf-krb-wg-bounces@lists.anl.gov

On Tue, Jun 21, 2011 at 7:12 AM, Josh Howlett <Josh.Howlett@ja.net> wrote:
> 1. Encoding
>
> The document specifies the use of ASN.1 encoding of attributes, on the
> basis that this is what Kerberos uses. As a general principle the choice
> of encoding should, IMO, be determined principally by the preferences of
> the parties expected to issue and consume the PAD. For the purposes of
> this document, I would expect those to be the KDC (issuer) and -- for
> modern usage of Kerberos -- the GSS acceptor (consumer). So, in the former
> case the choice of ASN.1 is reasonable. However, in the second case I
> would expect that application developers would prefer to use GSS-API
> naming extensions, rather than parse the PAD directly. Quoting
> draft-ietf-kitten-gssapi-naming-exts:

The original intention was to allow access to the raw authorization
data elements and even sub-elements.  Support for naming elements in a
SAML-friendly way came later, but I don't believe there's anything
requiring that the elements themselves be SAML elements.

Nico
--
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

v2.23.0 | Report a Bug | By Email