Subject: RE: Soliciting additional GSS/Kerberos interoperability results

From: "John Brezak" <[email-masked]>
Date: Thu, 10 May 2001 11:26:21 -0700

There appears to be an issue with gss_canonicalize_name when used with
Kerberos. If a middle tier server has multiple principals (as is
currently the case with Kerberos), how can gss_canonicalize name be used
in its described way for building a canonical name for that middle-tier
server that can be stored on ACLs?

-----Original Message-----
From: Douglas E. Engert [mailto:[email-masked]] 
Sent: Thursday, May 10, 2001 11:04 AM
To: Linn, John
Cc: [email-masked]'; 'CAT-WG List'
Subject: Re: Soliciting additional GSS/Kerberos interoperability results

"Linn, John" wrote:
> 
> Kerberos WG:
> 
> This will be familiar news for those also subscribing to the CAT-WG 
> mailing list, but I'd like to point out to others in the Kerberos 
> community that we're looking for interoperability testing results 
> which could support advancement of the GSS-API RFCs (2743, and 2744 
> and/or 2853) to Draft Standards.  We've some results already reported,

> but could use more.

If its 2743 and 2744 you would like to move along, then you must also be
interested  in GSS mechanisms other then Kerberos and how they could be
written to use these 
RFCs. The Globus GSI  which implements a GSS using PKI and SSL is one
example.
See: http://www.globus.org 

As we pointed out at the last IETF, we wished that there where a few
additions to the RFCs, but did not find any problems with the current
RFCs themselves. 

As an interoperability example, the Globus applications (including ssh
and ftp) are written to work with either the GSI or the Kerberos
mechanisms. This choice can be made at link time. When using the ssh
client, SecureCRT, on Windows, the choice can be made at run time via a
DLL. (If the mechglue was working for UNIX, UNIX could make the choice
at run time too.) 

So I would say that these RFCs are in good shape, and could move
forward. 

> Recognizing that several Kerberos-based GSS implementations exist, I'd

> like to solicit any summaries which their keepers can provide 
> concerning the scope of testing undertaken, other implementations that

> have been tested against, and particularly the sets of GSS-selectable 
> features which were exercised in testing.  Please send any results you

> can offer either to the CAT-WG list at [email-masked],

> or to me as CAT-WG chair. Thanks for any support you can provide in 
> this effort.
> 
> --jl

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Martin Rex <[email-masked]>
Date: Fri, 11 May 2001 11:57:48 +0200 (METDST)

> server that can be stored on ACLs?

Which particular problem are you referring to?
(MIT) Kerberos 5 doesn't have a problem here, it should be implementable
with DCE.  I know that Microsoft Kerberos has a problem, but that's
a design flaw.

We have certified more about a dozen different gssapi mechanisms for
interoperability with our application and none of them had a problem
with gss_canonicalize_name() ...

-Martin