Subject: [Fwd: Re: LC on draft-lha-gssapi-delegate-policy-03]

From: Shawn M Emery <[email-masked]>
Date: Wed, 31 Dec 2008 23:19:03 -0700

-------- Original Message --------
Subject: 	Re: LC on draft-lha-gssapi-delegate-policy-03
Date: 	Wed, 31 Dec 2008 10:17:55 -0800
From: 	Thomas Maslen <[email-masked]>
To: 	[email-masked] <[email-masked]>, 
[email-masked] <[email-masked]>
CC: 	[email-masked] <[email-masked]>, [email-masked] 
<[email-masked]>
References: 
<[email-masked]>

...

Perhaps I'm misreading (or not thinking clearly), but isn't there a slight discrepancy between section 4 and section 5?

Section 4 (about GSSAPI in general) says:

> [...] If the initiator set both the deleg_req_flag and deleg_policy_req_flag, delegation will attempted unconditionally.

Section 5 (applying this to the Kerberos mechanism) says:

> [...] If the initiator sets the deleg_policy_req_flag, the Kerberos GSS-API mechanism MUST only delegate if OK-AS-DELEGATE is set [RFC4120] in the service ticket.

and doesn't have any escape text to say e.g. "but if the initiator also set the deleg_req_flag then delegation will [be] attempted unconditionally".

My 0.02:  I agree with the semantics in section 4, and I believe that (both paragraphs in) section 5 should be tweaked to match section 4.

_______________________________________________
Kitten mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/kitten