Subject: Re: Soliciting additional GSS/Kerberos interoperability results

From: Nicolas Williams <[email-masked]>
Date: Fri, 11 May 2001 17:31:56 -0400

Fine, but again, gss_canon_name() is not involed. It's upto the
application calling gss_init_sec_context() (or the SSPI equivalent) to
*know* which name they mean to be!

Nico

On Fri, May 11, 2001 at 02:25:47PM -0700, John Brezak wrote:
> There are many cases where the name can not be the same. A host can be
> known by any number of names. Consider the case of virtual ip addresses
> in hosted web server environments.
> 
> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]] 
> Sent: Friday, May 11, 2001 2:18 PM
> To: John Brezak
> Cc: [email-masked]; [email-masked]
> Subject: Re: Soliciting additional GSS/Kerberos interoperability results
> 
> 
> That host should have one canonical name for all its addresses, meaning
> there should be one DNS PTR RR for each of its IP addresses, all of
> which reference the same canonical name. But that host could have
> multiple aliases, and those aliases may be in the form of CNAME RRs
> (preferred) or A RRs (ok).
> 
> See my preceding mail for an example
> 
> Also, gss_canonicalize_name() accepts a GSS-API name structure and
> returns another one with all but one mechanism-specific names removed;
> GSS-API names are allowed to contain just one name for each mechanism
> supported by that GSS-API implementation.
> 
> Nico
> 
> On Fri, May 11, 2001 at 11:39:51AM -0700, John Brezak wrote:
> > Consider this scenario. Clients connect to a computer that is known by
> 
> > multiple DNS name - foo.dns.com, bar.dns.com and baz.xyz.com. As a 
> > result it has these Kerberos principals - host/foo.dns.com, 
> > host/bar.dns.com, host/baz.xyz.com.
> > 
> > This host is the middle tier of an application and needs to access a 
> > database on another server. That server authenticates the middle tier 
> > server and needs to have it's identity on the database access control 
> > lists. In order for this to work, all 3 principal names would have to 
> > be on the ACLs, but there is no canonical name for the host. The 
> > database server only knows that host as "baz.xyz.com".
> > 
> > What is the expected behavior of gss_canonicalize_name when presented 
> > with these principals for the same application?
> --
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 11 May 2001 17:34:29 -0400

Also, if the application has access to only one identity (one keytab, or
the LSA equivalent), then the app doesn't have to know, it can just use
the one set of creds it can access, and this is the default in GSS-API.

Nico

On Fri, May 11, 2001 at 05:31:56PM -0400, Nicolas Williams wrote:
> .
--

---

From: "John Brezak" <[email-masked]>
Date: Fri, 11 May 2001 14:25:47 -0700

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Friday, May 11, 2001 2:18 PM
To: John Brezak
Cc: [email-masked]; [email-masked]
Subject: Re: Soliciting additional GSS/Kerberos interoperability results

Nico

--