[TLS] RE: Last call comments for draft-santesson-tls-(ume-04, supp-00)

Russ Housley wrote:
> 
> Pasi:
> 
> >4) tls-ume: Would it make sense to define two UserMappingData types,
> >    one for "user@domain" and another one for just "domain", instead
> >    of combining them in one type?
> 
> I do not think so.  The name is user@domain.  It would be meaningless 
> if only user was present, and t would me meaningless if only domain 
> was present.

I don't know if it's meaningless or not, but the current draft does 
say that 

   The UpnDomainHint MUST at least contain a non empty 
   user_principal_name or a non empty domain_name. The UpnDomainHint 
   MAY contain both user_principal_name and domain_name.

In other words, one of the fields can be empty. And since the 
user_principal_name field is of the form "user@domain",
it looks like the UpnDomainHint structure can actually contain
two _different_ domain names. In other words, the spec does
allow things like:

  UserMappingData {
    user_mapping_version = upn_domain_hint(0)
    UpnDomainHint {
      user_principal_name = "foo@example.com"
      domain_name = "bar.example.net"
    }
  }

But the draft currently does not explain what this would mean,
or what the domain-name-only hints are (perhaps they're "Host Mapping
Data" for host certificates instead of user certs, or something). 
This needs to be clarified.

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls