[SPKM] RE: Comments on draft-zhu-pku2u-01.txt

On Fri, 16 Mar 2007, Liqiang(Larry) Zhu wrote:

> 6. User to User when applied by server policy
>
>    In the case that the client application doesn't know that a service
>    requires user-to-user authentication, and requests and receives a
>    conventional KRB_AP_REP, the client will send the KRB_AP_REP
>    request, and the server will respond with a KRB_ERROR token as
>    described in RFC1964, with a msg-type of
>    KRB_AP_ERR_USER_TO_USER_REQUIRED (0x45). The server may optionally
>    pass the TGT in the data field of this error message. In response to
>    this error, the initiator sets flags and returns a
>    GSS_C_CONTINUE_NEEDED so that the next round uses the mechanism
>    described in section 4.

While this is a token carrying a KRB_ERROR, it's not an "error token" in
the sense that we're talking about.  In the context of Olga's and my
comments, an "error token" is one which causes the peer to abort context
establishment and return an error status to its caller.  Such a token
should never be returned with GSS_S_CONTINUE_NEEDED, because no reply is
expected.

-- Jeff

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm