Subject: RE: Testing the concensus of the krb-wg on IDN

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 21 Oct 2003 01:33:33 -0700

Martin Rex wrote:

>> I was surprized a few days ago when I realized that Microsoft's SSPI
>> does an automatic uppercasing of an explicitly supplied REALM name.

MS clients do NOT automatically uppercase the realm names. Have you seen
a case where MS clients return an upper-cased MIT realm name when the
realm name is really in lower cases? If so, please let me know.

What happens here is that a MS client is not required to know the exact
case of the domain name, instead, the client can choose to ask the KDC
and it does so by requesting the kdc option name_canonicalize (covered
in the JBrezak drafts).  This is apparently necessary due to the fact
that pre-w2k domain names are case-insensitive.

>> However if the initiator does a QueryCredentialsAttributes() on these
>> initiating credentials, then it will receive the Realm name in
>> exactly the fashion that it was passed to AcquireCredentialsHandle()
>> -- OUCH!

When you supply explicit credentials and the client won't be able to
have the names normalized till it contacts the KDCs (mostly during the
InitializeSecurityContext call), this is why the realm name is not
upper-cased on the initiator side but might get upper-cased on the
acceptor side if the acceptor is in an MS domain.

The client might optimistically upper-case the realm name during the
initial pre-auth, but such decision is not authoritative and is for
optimization only.

Does this explain what you have observed? In the future, please feel
free to drop me a line when you are un-certain about some aspects of the
MS Kerberos implementation.

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Martin Rex
Sent: Monday, October 20, 2003 9:26 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Testing the concensus of the krb-wg on IDN

Jeffrey Altman wrote:
> 
> Some application software provides an option to "uppercase realm
names";
> most do not.  The reason applications do not do this automatically is
> because doing so breaks the ability of users to communicate with
existing
> realms.

I was surprized a few days ago when I realized that Microsoft's SSPI
does an automatic uppercasing of an explicitly supplied REALM name.

Unfortunately they do it in a very inconsistent fashion,
i.e. when you call AcquireCredentialsHandle() with an explicitly
supplied user+Realm (in an AUTH_IDENTITY structure) on the
initiator side and perform an authentication with a server,
then the authentication will succeed and the Server will
correctly display the users realm in all-uppercase.

However if the initiator does a QueryCredentialsAttributes() on these
initiating credentials, then it will receive the Realm name in
exactly the fashion that it was passed to AcquireCredentialsHandle()
-- OUCH!

-Martin

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 21 Oct 2003 10:11:21 -0400

Assuming you have DNSSEC you can perform a similar technique on the 
Kerberos client.
When receiving a realm string from the end user, you query DNS for

  _kerberos.realm.  TXT    "REALM"

If the realm and domain are the same except that they differ by case, 
you receive back the name of the realm with the appropriate case 
intact.  The text string is a case preserving
ASCII string. 

- Jeff