Subject: Re: [Ietf-krb-wg] Question about draft-ietf-krb-wg-kerberos-referrals

From: "Tim Alsop" <[email-masked]>
Date: Thu, 17 Jan 2008 15:49:18 -0000

Jeffrey,

Thankyou for your suggestion.

I have seen many references to the word "referral" in reference to
Kerberos and I wanted to clarify my understanding. I hope somebody can
help me.

My understanding is as follows:

I am not 100% sure of the exact changes which were made (I cannot find
any documentation which describes the exact changes made), but I know
that when MS first introduced Kerberos in Windows 2000, if ksetup was
used to enable Windows logon using a principal from a non-MS realm, it
seemed that some ticket requests were sent to the non-MS realm, instead
of being sent to the MS AD realm which the workstation was a member of.
Since the Windows workstation was sending ticket requests to the wrong
realm, the non-MS realm had to refer requests received to the MS AD
realm, therefore a Microsoft proprietary referral method had to be coded
in the KDC to inform Windows to send the request again to another realm.
Then, at some point after Windows 2000 was released and before Windows
XP/2003/Vista, some changes were made to the Windows Kerberos code, and
now a cross realm TGT is issued for the realm used in the TGS request so
that the client can send the TGS request to the MS AD realm and get the
required service ticket. This cross realm method of TGS referral is
standard, and I guess is why MS changed the way that referrals were
implemented.

So, is the above description correct ?

My understanding regarding the IETF Kerb WG referral draft, is that it
is mainly being progressed to provide a better way to map host/domain
names onto realm names for when service tickets are required. This would
then avoid having to use DNS or client side configuration for mapping
purposes. Then, when a client sends a TGS request to the wrong realm,
the realm will know which realm the principal is in, and issue the cross
realm TGT for the correct realm. The client will then use the cross
realm TGT to send the request again to the correct realm. Is this
correct ?

Thanks,
Tim

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: 17 January 2008 05:34
To: Tim Alsop; [email-masked]
Cc: [email-masked]
Subject: Re: Question about draft-ietf-krb-wg-kerberos-referrals

--On Thursday, January 03, 2008 12:47:45 PM +0000 Tim Alsop 
<[email-masked]> wrote:

> I wondered if somebody could give me some advice on the referrals
draft

As Jeff pointed out, this draft is the subject of current work in the 
IETF's Kerberos working group.  The appropriate forum for discussing the

draft and the protocol it describes is the Kerberos Working Group
mailing 
list, [email-masked].  Any comments on this document would be
welcome 
there.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Co-Chair, IETF Kerberos Working Group
   Carnegie Mellon University - Pittsburgh, PA

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Sat, 26 Jan 2008 23:54:54 -0800

Tim, your understanding is correct. The referrals ID defines a method via which the client can authenticate to a server of a different realm without costly client side configuration.

--larry
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Tim Alsop
Sent: Thursday, January 17, 2008 7:49 AM
To: IETF Kerberos Working Group
Cc: Tim Alsop; Jeffrey Hutzelman
Subject: Re: [Ietf-krb-wg] Question about draft-ietf-krb-wg-kerberos-referrals

Jeffrey,

Thanks,
Tim

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]]
Sent: 17 January 2008 05:34
To: Tim Alsop; [email-masked]
Cc: [email-masked]
Subject: Re: Question about draft-ietf-krb-wg-kerberos-referrals

draft

---

From: "Tim Alsop" <[email-masked]>
Date: Sun, 27 Jan 2008 14:38:52 -0000

Larry,

Thank you for confirming this for me.

Take care,
Tim

-----Original Message-----
From: Larry Zhu [mailto:[email-masked]] 
Sent: 27 January 2008 07:55
To: Tim Alsop; IETF Kerberos Working Group
Cc: Jeffrey Hutzelman
Subject: RE: [Ietf-krb-wg] Question
aboutdraft-ietf-krb-wg-kerberos-referrals

Tim, your understanding is correct. The referrals ID defines a method
via which the client can authenticate to a server of a different realm
without costly client side configuration.

--larry
-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Tim Alsop
Sent: Thursday, January 17, 2008 7:49 AM
To: IETF Kerberos Working Group
Cc: Tim Alsop; Jeffrey Hutzelman
Subject: Re: [Ietf-krb-wg] Question about
draft-ietf-krb-wg-kerberos-referrals

Jeffrey,

Thanks,
Tim

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]]
Sent: 17 January 2008 05:34
To: Tim Alsop; [email-masked]
Cc: [email-masked]
Subject: Re: Question about draft-ietf-krb-wg-kerberos-referrals

draft