Subject: [kitten] Naming Extensions

From: Sam Hartman <[email-masked]>
Date: Mon, 07 Feb 2011 20:53:25 -0500

At IETF 78, I agreed to work on resolving some issues I brought up with
draft-ietf-kitten-gssapi-naming-exts. I believe I did that; I believe
Leif will be posting a proposed revision within the next day or so.

There's one area that Leif was surprised by in my changes.  I thought we
had agreed to it at IETF 78, but I want to specifically call it out
here.

I'm proposing to remove the details of how names work for Kerberos, SAML
and PKIX mechanisms.  My rationale is that when I tried to put together
draft-ietf-abfab-gss-eap-naming (naming of SAML attributes for ABFAB), I
found it was much more complex than I had previously expected.  I
believe the existing text will lead to problems for the reasons I gave
at IETF 78.

For example, I think the Kerberos names will have dependencies on
exactly what KDC issued container is in use for authenticated names. See
the ongoing discussion of trust in the Kerberos group.
I'm not at all sure that draft-ietf-abfab-gss-eap-naming would be
generic to use of SAML say inside Kerberos or certificates.

I definitely think the PKIX stuff needs some work.

So, I propose that we remove all these specific details from the core
spec. We should let ABFAB tackle SAML at least so far as it is within
ABFAB's scope.  I suspect that once we've done that and once the current
PAC discussions in krb-wg move forward a bit, we'll know what to say
about naming extensions for Kerberos.  I think saying it in krb-wg would
be fine, although we could say it here if we like.

I'd definitely like to get more PKIX involvement before we saying
anything about their named objects.

How do people feel about this direction?