Subject: GSS_Inquire_name()

From: Love Hörnquist Åstrand <[email-masked]>
Date: Sun, 13 Sep 2009 15:24:04 -0700

GSS_Inquire_name does not describe the relationship between all,  
asserted and authenticated names.

Love

---

From: Leif Johansson <[email-masked]>
Date: Mon, 14 Sep 2009 09:38:25 +0200

> asserted and authenticated names.

I sortof think I may understand but feel free to expand on your thoughts :-)

	Cheers Leif

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Mon, 14 Sep 2009 00:51:26 -0700

> I sortof think I may understand but feel free to expand on your  

Are all names in all or just the one that are not in asserted/ 
authenticaticated names ?

Love

---

From: Leif Johansson <[email-masked]>
Date: Mon, 14 Sep 2009 10:07:20 +0200

> authenticaticated names ?

Do you mean "are there attributes that are neither asserted nor 
authenticated?"

	Cheers Leif

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Mon, 14 Sep 2009 09:34:38 -0700

> Do you mean "are there attributes that are neither asserted nor

I mean is all = asserted + authenticate or all = asserted +  
authenticated + other
or all = other - asserted - authenticated

all = something else,

why is there an all and asserted, and authenticated, and why no  
complete too

Just remove asserted and authenticated and just have an "all".

Love

---

From: Luke Howard <[email-masked]>
Date: Tue, 15 Sep 2009 22:06:47 +0200

> Do you mean "are there attributes that are neither asserted nor

As an implementer this left me completely confused too.

BTW, see:

	http://k5wiki.kerberos.org/wiki/Projects/VerifyAuthData

for actual implementation experience.

-- Luke

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Sep 2009 15:31:21 -0500

> for actual implementation experience.

I can't quite remember what I had intended :(

I think I must have meant 'all_attrs' to be the union of the other two
purely for conviennce.  But on second (or third) thought I can't see why
an app might care for attrs without caring as to whether they are
authenticated or asserted.

(Also, there is the more general problem of what entity authenticated a
given attribute.  But for now I think GSS_Inquire_name() is plenty good
enough, minus the all_attrs argument anyways.)

Nico
--

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 15 Sep 2009 14:00:19 -0700

> enough, minus the all_attrs argument anyways.)

So when should applications care about the name exists w/o checking  
content ?

I think there should only be an "all" and caller have to call get-name- 
attribute to get the attribute.

Love

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Sep 2009 16:00:40 -0500

> So when should applications care about the name exists w/o checking  

?

> attribute to get the attribute.

That works for me.  I like it.

Nico
--

---

From: Luke Howard <[email-masked]>
Date: Tue, 15 Sep 2009 23:48:57 +0200

> That works for me.  I like it.

Likewise. Checked in.

-- Luke