Subject: Kerberos WG: draft-brezak-spnego-http-00.txt

From: Martin Rex <[email-masked]>
Date: Mon, 8 Oct 2001 11:29:54 +0200 (MET DST)

John Brezak wrote:
> I will be posting an updated I-D that address the HTTP use of SPNEGO
> based on some of the questions and comments on the list.
> 
> A preview:
> - HTTP/SPNEGO as implemented in Win2000 is limited to those mech-types
> that complete in 1 or 1.5 round trips - such as Kerberos and NTLM. The
> updated draft contains the details.
>
> - The client can preemptively send an Authorization header with a
> Negotiate+gssapi-data when it "knows" that a particular server can
> accept this Authentication mechanism.

1.5 roundtrips?  Is that 1 roundtrip plus a "challenge" from the
initial "HTTP/1.1 401 Unauthorized" reply -- this would explain how
the term "challenge" got the description of the WWW-Authenticate field.
As I explained this wouldn't fly with SPNEGO (rfc2478) since there
is no gssapi token prior to NegTokenInit.

But if that was the case, then I would have to wonder how a client could 
short-cut further requests by preemtively sending an Authorization
header with the NTLM mechanism, since the initial challenge from the
server is the only way to prevent replay attacks with NTLM...

> 
> Specifc questions about implementation of SPNEGO will not be addressed
> in this Internet-Draft.
 
I already mentioned this as well: there is one detail that you should
definitely document and that is whether your SPNEGO (acceptor) will
accept a plain rfc-1964 context establishment which every sensible
implementation of SPNEGO will support.

-Martin

---

From: "Paul Leach" <[email-masked]>
Date: Mon, 8 Oct 2001 19:33:31 -0700

To repeat what I said -- we have documented what it does.

Right now, for not entirely intended reasons, it doesn't do arbitrary
number of round trips. We aren't trying to justify it -- that's just the
way it is.

As far as I know, the IIS (our web server) side would be happy with a
client that wanted to do more round trips, but IE will only handle 1 or
1.5 round trips. We're looking into it.

This means that
1. The optimistic mode of SPNEGO must be used by the client
2. The optimistically chosen mechanism must be supported by the server
3. The chosen mechanism must require no more than 1.5 round trips

I think that's a fairly clear and complete specification of the
restrictions on full SPNEGO that need to be understood by someone
wanting to make an interoperable implementation. I also think that for a
client that supports a full SPNEGO and Kerberos implementation, they
would take little and maybe even no change to those implementations to
meet these requirements.

This indeed means that SPNEGO isn't being taken full advantage of. As I
said, that wasn't entirely intentional. However, the way forward to
making full use of SPNEGO is hopefully easier than if we hadn't used it.

Paul

---

From: "John Brezak" <[email-masked]>
Date: Tue, 16 Oct 2001 07:54:53 -0700

Hopefully by next week.

-----Original Message-----
From: Tim Bass [mailto:[email-masked]] 
Sent: Monday, October 15, 2001 10:15 AM
To: John Brezak
Cc: [email-masked]
Subject: Re: Kerberos WG: draft-brezak-spnego-http-00.txt

Hi John,

Just curious..... is there a time-table for the release of the next
revision of your draft-brezak-spnego-http-00.txt document?

Finest Regards, Tim

www.silkroad.com

----- Original Message -----
From: "John Brezak" <[email-masked]>
To: "Nicolas Williams" <[email-masked]>; <[email-masked]>
Cc: <[email-masked]>; "Paul Leach" <[email-masked]>
Sent: Monday, October 08, 2001 5:29 PM
Subject: RE: Kerberos WG: draft-brezak-spnego-http-00.txt

>
>
> -----Original Message-----
> From: Nicolas Williams [mailto:[email-masked]]
> Sent: Monday, October 08, 2001 10:23 AM
> To: John Brezak; [email-masked]
> Cc: [email-masked]; Paul Leach
> Subject: Re: Kerberos WG: draft-brezak-spnego-http-00.txt
>
>
> On Mon, Oct 08, 2001 at 09:07:33AM -0700, John Brezak wrote:
> > Below [JBrezak].
> >
> > -----Original Message-----
> > From: Martin Rex [mailto:[email-masked]]
> > Sent: Monday, October 08, 2001 2:30 AM
> > To: John Brezak; Paul Leach
> > Cc: [email-masked]
> > Subject: Kerberos WG: draft-brezak-spnego-http-00.txt
> >
> > John Brezak wrote:
> > > I will be posting an updated I-D that address the HTTP use of 
> > > SPNEGO based on some of the questions and comments on the list.
> > >
> > > A preview:
> > > that complete in 1 or 1.5 round trips - such as Kerberos and NTLM.

> > > The
> > the term "challenge" got the description of the WWW-Authenticate 
> > field. As I explained this wouldn't fly with SPNEGO (rfc2478) since 
> > there is no gssapi token prior to NegTokenInit.
> >
> > [JBrezak] When using Kerberos it is just a single round trip:
>
> Well, reading the IAKERB draft, it is 1.5 round-trips *at the GSS 
> level* when using IAKERB. So, how are 3rd, 4th, ..., Nth GSS tokens 
> exchanged?
>
> That is the question. Er, one of them.
>
> [Jbrezak] This is not related to IAKERB at all. When using Kerberos, 
> the HTTP/Auth uses a single round-trip. I'm checking into when NTLM is

> used under Negotiate and will include that information in the I-D 
> update.
>
> [...]
>
> > [JBrezak] The server acts as a universal responder since it can 
> > distinguish between Kerberos, SPNEGO, and NTLM based on OID. However

> > the client will use SPNEGO with an optimistic blob based on whether 
> > the KDC returned a service ticket for the target server. If the KDC 
> > didn't know about the service, then NTLM is used as the optimistic 
> > mechanism.
>
>
> > I already mentioned this as well: there is one detail that you 
> > should definitely document and that is whether your SPNEGO 
> > (acceptor) will accept a plain rfc-1964 context establishment which 
> > every sensible implementation of SPNEGO will support.
> >
> > [JBrezak] Answered above.
>
> How? Not that it matters. If the draft says "SPNEGO" then the acceptor

> should be able to accept non-SPNEGO GSS initial tokens for mechs the 
> acceptor supports. This being an informational draft the question of 
> how MS' implementation behaves in this respect in quite interesting, 
> but if it is to be a standards track draft then the question is not 
> probably no longer relevant to the draft.
>
> [JBrezak] The Windows 2000 implementation of the Negotiate acceptor 
> will accept SPNEGO, Kerberos or NTLM "blobs" and pass them off to the 
> appropriate security package. This is done for server applications so 
> that they can transparently accept authentication requests from 
> downlevel clients. Otherwise the server code can become quite 
> complicated when it would have to deal with SPNEGO, Kerberos, NTLM, 
> etc.
>
> This is more of an implementation note that really doesn't affect 
> HTTP/Auth, because the server will always be getting SPNEGO "blobs" 
> from the client that implements spnego-http auth.
>
> Cheers,
>
> Nico
> --
> -DISCLAIMER: an automatically appended disclaimer may follow. By
> posting- -to a public e-mail mailing list I hereby grant permission to
> distribute- -and copy this message.-
>
> Visit our website at http://www.ubswarburg.com
>
> This message contains confidential information and is intended only 
> for the individual named.  If you are not the named addressee you 
> should not disseminate, distribute or copy this e-mail.  Please notify

> the sender immediately by e-mail if you have received this e-mail by 
> mistake and delete this e-mail from your system.
>
> E-mail transmission cannot be guaranteed to be secure or error-free as

> information could be intercepted, corrupted, lost, destroyed, arrive 
> late or incomplete, or contain viruses.  The sender therefore does not

> accept liability for any errors or omissions in the contents of this 
> message which arise as a result of e-mail transmission.  If 
> verification is required please request a hard-copy version.  This 
> message is provided for informational purposes and should not be 
> construed as a solicitation or offer to buy or sell any securities or 
> related financial instruments.
>