Subject: [TLS] RE: Last call comments for draft-santesson-tls-(ume-04, supp-00)

From: "Stefan Santesson" <[email-masked]>
Date: Tue, 4 Apr 2006 00:07:55 +0100

Sometimes it is sufficient to specify the domain as the user name is
provided by the cert but that cert is used to access multiple accounts
in different domains. In other cases the full name@domain is needed.

We chose to provide for both alternatives using the same hint type.
This works well and I would prefer to keep it that way.

Stefan Santesson
Program Manager, Standards Liaison
Windows Security

> -----Original Message-----
> From: Russ Housley [mailto:[email-masked]]
> Sent: den 3 april 2006 17:10
> To: [email-masked]; Stefan Santesson
> Cc: [email-masked]
> Subject: RE: Last call comments for
draft-santesson-tls-(ume-04,supp-00)
> 
> Pasi:
> 
> My comments were with respect to the user_principal_name within the
> UpnDomainHint.  Sorry for being ambiguous.
> 
> Russ
> 
> 
> >Russ Housley wrote:
> > >
> > > Pasi:
> > >
> > > >4) tls-ume: Would it make sense to define two UserMappingData
types,
> > > >    one for "user@domain" and another one for just "domain",
instead
> > > >    of combining them in one type?
> > >
> > > I do not think so.  The name is user@domain.  It would be
meaningless
> > > if only user was present, and t would me meaningless if only
domain
> > > was present.
> >
> >I don't know if it's meaningless or not, but the current draft does
> >say that
> >
> >    The UpnDomainHint MUST at least contain a non empty
> >    user_principal_name or a non empty domain_name. The UpnDomainHint
> >    MAY contain both user_principal_name and domain_name.
> >
> >In other words, one of the fields can be empty. And since the
> >user_principal_name field is of the form "user@domain",
> >it looks like the UpnDomainHint structure can actually contain
> >two _different_ domain names. In other words, the spec does
> >allow things like:
> >
> >   UserMappingData {
> >     user_mapping_version = upn_domain_hint(0)
> >     UpnDomainHint {
> >       user_principal_name = "[email-masked]"
> >       domain_name = "bar.example.net"
> >     }
> >   }
> >
> >But the draft currently does not explain what this would mean,
> >or what the domain-name-only hints are (perhaps they're "Host Mapping
> >Data" for host certificates instead of user certs, or something).
> >This needs to be clarified.
> >
> >Best regards,
> >Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: <[email-masked]>
Date: Tue, 4 Apr 2006 12:17:15 +0300

Stefan,

Thanks for the clarification. Please include text about this 
in the draft as well.

Best regards,
Pasi 

> From: ext Stefan Santesson [mailto:[email-masked]] 
> Sent: 04 April, 2006 02:08
> To: Russ Housley; Eronen Pasi (Nokia-NRC/Helsinki)
> Cc: [email-masked]

---

From: Russ Housley <[email-masked]>
Date: Tue, 04 Apr 2006 14:14:59 -0400

It is okay with me, but your description does not match the 
text.  Based on your note, the domain must be present, and the upn is 
optional.  The text that Pasi quoted needs to be replaced with a 
sentence that says this.

Then, you need to add a paragraph that explains the processing when 
only the domain is present, and then an paragraph that explains the 
processing when both the domain and the upn are present.

Russ