Subject: RE: Proposed Changes to PKINIT

From: "Friedrichs, Paul LCDR" <[email-masked]>
Date: Wed, 28 Feb 2001 16:26:37 -0500

Nico,

> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]

......

> Yes. Users like flat namespaces, and I don't blame them nor 
> do I want to take those away.

I represent not so much the user as the credential service providers (e.g.,
the personnel offices) and their customers. These, too, benefit from flat
names.

> I should explain what I meant below a bit further: I
> work at a bank, one that has been through countless mergers and
> acquisitions over the last decade and, in my experience, hierarchical
> namespaces make the technology aspect of the merger much 
> easier even if
> in time a cleanup is done to end up with a single flat namespace.
> 
> So, what I'm advocating is not that namespaces be 
> hierarchical, but that
> the option be available, because there are times when hierarchical
> namespaces can really simplify things.

I agree. Hierarchical naming is invaluable and unavoidable at the top. Thus
far, we've learned it is best for us to push flat naming as high as we can,
and then rely on, e.g., X.500 naming to support such reshuffling as you
describe. (The DoD doesn't plan to completely merge with others soon, so we
can bound our expectations.) We considered attempting flat naming across the
Federal government, but we thought it would take too long to convince all
the players.....

Thanks,

Paul

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 28 Feb 2001 17:20:26 -0500

Going back to multi-realm situations, you essentially have non-flat
namespaces and, in those cases, having support for that at the OS (and
application) levels, is best.

Thus, if user1@A tries to log into host/somehost.fqdn@B then you either:

a) need to map user1@A to a user local to somehost.fqdn,

b) need to map user1@A to a user local to realm B

or

c) somehost.fqdn supports non-flat identifiers and thus no mapping is
   needed

Which of (a), (b) or (c) you must do depends on the OSs involved. In a
pure win2k environment (I bet you don't have one :) (c) is supposed to
be the way to go.

Look, Kerberos has never had a flat namespace, and in so many ways
Kerberos, though it grew up on Unix, has had some serious support issues
wrt Unix. The hierarchical namespace of Kerberos vs. the flat namespace
of Unix is one example. Another is the lack of a distributed UPN <->
Unix user account mapping service.

Oh well. Then again, the Unix vendors/developers could add support for
multiple different types of process credentials. This is out-of-scope
for this list though.

Nico

--