Subject: RE: Comments: draft-williams-krb5-gssapi-domain-based-name

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 22 Oct 2004 15:22:23 -0700

Nicolas Williams wrote:
> So, let me rephrase: what is the benefit of changing the generic
domain-based name syntax as Larry requests?

1) you can transform the domain based names to Kerberos principal name
(when using SSPI, sorry about that, something you may not care but we
do) simply by replacing the '@' with '/', this is consistent with how
host-based services  are treated when used with SSPI.

2) you may include your "domain based services" as an extended name form
of "host based services", therefore they are really the same name type
as Paul suggested.

3) as an incremental change it has the benefit of being
backward-compatible(please note I said this rather loosely).

as I as I can tell, you only have a weak preference and do not have a
strong feeling here.
-- Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Friday, October 22, 2004 3:08 PM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; Paul Leach
Subject: Re: Comments: draft-williams-krb5-gssapi-domain-based-name

On Thu, Oct 21, 2004 at 11:46:25AM -0500, Nicolas Williams wrote:
> The application still requires changing though, to use the new name 
> type OID.  Or is there something about the SSPI that obviates the need

> for name type OIDs?

Sorry I asked that.  I didn't mean to start a thread about bugs in an
implementation on this list.

So, let me rephrase: what is the benefit of changing the generic
domain-based name syntax as Larry requests?

To me it's almost six of one, half a dozen of the other.  Except for
this: service@@host instantly looks like a domain based name using a
default domain, to me, so I prefer it.

Nico
-- 

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 22 Oct 2004 17:28:15 -0500

> host-based services  are treated when used with SSPI.

Well, this transformation is just as simple either way, so, color me
unconvinced by (1)

> of "host based services", therefore they are really the same name type

This falls in the same category as (1) :)

> backward-compatible(please note I said this rather loosely).

As far as the GSS-API is concerned (3) is not applicable: you must
change the app to use the new OID when you want domain-based names
anyways, so (3) falls in the same category as (1).

> as I as I can tell, you only have a weak preference and do not have a

Yeah, but I want to to be convinced one way or the other.  I have one
argument, obvious difference, that I find mildly convincing for one way
and none that I find convincing for the other.

Perhaps Martin or Sam have something to say about this?

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 25 Oct 2004 18:00:29 -0400

I'd prefer for the Kerberos MN for domain-based names to be Windows
compatible unless there is a compelling reason not to do so.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 25 Oct 2004 17:03:39 -0500

> compatible unless there is a compelling reason not to do so.

I've already agreed to that.  In fact, I thought I'd made sure I had the
Windows convention right; guess not.

Nico
--