[TLS] RE: Last call comments for draft-santesson-tls-(ume-04, supp-00)

I'm sorry if my text was unclear.

If you specify UPN, then domain is automatically included in the UPN.
I'm preparing a new text proposal. I will send it tomorrow morning.
That will include processing and normalization of the domain component
which is Unicode UTF-8 normalized with Nameprep.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: Russ Housley [mailto:housley@vigilsec.com]
> Sent: den 4 april 2006 20:15
> To: Stefan Santesson; Pasi.Eronen@nokia.com
> Cc: tls@ietf.org
> Subject: RE: Last call comments for
draft-santesson-tls-(ume-04,supp-00)
> 
> It is okay with me, but your description does not match the
> text.  Based on your note, the domain must be present, and the upn is
> optional.  The text that Pasi quoted needs to be replaced with a
> sentence that says this.
> 
> Then, you need to add a paragraph that explains the processing when
> only the domain is present, and then an paragraph that explains the
> processing when both the domain and the upn are present.
> 
> Russ
> 
> 
> At 07:07 PM 4/3/2006, Stefan Santesson wrote:
> >Sometimes it is sufficient to specify the domain as the user name is
> >provided by the cert but that cert is used to access multiple
accounts
> >in different domains. In other cases the full name@domain is needed.
> >
> >We chose to provide for both alternatives using the same hint type.
> >This works well and I would prefer to keep it that way.
> >
> >
> >Stefan Santesson
> >Program Manager, Standards Liaison
> >Windows Security
> >
> >
> > > -----Original Message-----
> > > From: Russ Housley [mailto:housley@vigilsec.com]
> > > Sent: den 3 april 2006 17:10
> > > To: Pasi.Eronen@nokia.com; Stefan Santesson
> > > Cc: tls@ietf.org
> > > Subject: RE: Last call comments for
> >draft-santesson-tls-(ume-04,supp-00)
> > >
> > > Pasi:
> > >
> > > My comments were with respect to the user_principal_name within
the
> > > UpnDomainHint.  Sorry for being ambiguous.
> > >
> > > Russ
> > >
> > >
> > > >Russ Housley wrote:
> > > > >
> > > > > Pasi:
> > > > >
> > > > > >4) tls-ume: Would it make sense to define two UserMappingData
> >types,
> > > > > >    one for "user@domain" and another one for just "domain",
> >instead
> > > > > >    of combining them in one type?
> > > > >
> > > > > I do not think so.  The name is user@domain.  It would be
> >meaningless
> > > > > if only user was present, and t would me meaningless if only
> >domain
> > > > > was present.
> > > >
> > > >I don't know if it's meaningless or not, but the current draft
does
> > > >say that
> > > >
> > > >    The UpnDomainHint MUST at least contain a non empty
> > > >    user_principal_name or a non empty domain_name. The
UpnDomainHint
> > > >    MAY contain both user_principal_name and domain_name.
> > > >
> > > >In other words, one of the fields can be empty. And since the
> > > >user_principal_name field is of the form "user@domain",
> > > >it looks like the UpnDomainHint structure can actually contain
> > > >two _different_ domain names. In other words, the spec does
> > > >allow things like:
> > > >
> > > >   UserMappingData {
> > > >     user_mapping_version = upn_domain_hint(0)
> > > >     UpnDomainHint {
> > > >       user_principal_name = "foo@example.com"
> > > >       domain_name = "bar.example.net"
> > > >     }
> > > >   }
> > > >
> > > >But the draft currently does not explain what this would mean,
> > > >or what the domain-name-only hints are (perhaps they're "Host
Mapping
> > > >Data" for host certificates instead of user certs, or something).
> > > >This needs to be clarified.
> > > >
> > > >Best regards,
> > > >Pasi

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls