Subject: Comments: draft-williams-krb5-gssapi-domain-based-name

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 21 Oct 2004 06:46:31 -0700

Windows 2000 has shipped services with the "domain based" names, but the
DC name is the second component, and the domain name is the third
component.

For example, the Kerberos principal name for our LDAP servers is in the
form of "ldap/<DC name>/<domain name>@<DOMAIN NAME>".

If you do not have a good reason for what is in the current draft,
please adjust the order for interoperability and backward-compatibility.

For consistency, please change the generic "domain based name" to
service@host@domain, when the domain name is absent, this can simply be
service@host (NOT service@host@).

-- Larry

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 21 Oct 2004 11:31:12 -0500

> form of "ldap/<DC name>/<domain name>@<DOMAIN NAME>".

Is <DC name> a NetBIOS name?

> please adjust the order for interoperability and backward-compatibility.

I didn't have a good reason for any one particular ordering of the
components.

> service@host (NOT service@host@).

The generic syntax has it as service@@host when the domain part is
missing.  This is only useful in query form (i.e., as an input to
GSS_Import_name()).

And it has the benefit of looking different from hostbased names.  Or,
at least, I thought it was a benefit.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Sun, 24 Oct 2004 13:43:54 -0400

Why do we want to support domain based names with a null domain?

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 24 Oct 2004 16:00:36 -0500

> Why do we want to support domain based names with a null domain?

Only for the query syntax (i.e., for input to gss_import_name()).
Domain-based MNs should always have all three components.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 25 Oct 2004 12:42:24 -0500

> Domain-based MNs should always have all three components.

I was trying to explain this again today when I convinced myself that
even for the query syntax the domain part should be required, otherwise
we create potential security problems in discovering what to fill for
the domain part.

Nico
--