Re: [Ietf-krb-wg] the PKU2U DN to Kerberos Principal name mapping

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Mon, Jan 28, 2008 at 03:46:07PM -0800, Henry B. Hotz wrote:
> Since I'm not on that list, I'll throw my 2 cents in here:

[Cc'ing the KITTEN list and you, dropping the KRB WG list.]

> It would be nice if you could do a gss_compare_name() between  
> smith at EXAMPLE.COM and uid=smith,ou=People,dc=example,dc=com and get a  
> "true" result.  I think the detail you threw out was headed in that  
> direction, but it wasn't clear to me if it would get you all the way  
> there.

Well, that might work given the text I gave Larry in a very specific
context, namely that if one of the arguments to GSS_Compare_name() is a
NAME object imported with GSS_Import_name() but not canonicalized and
the other argument is a NAME object that is what I called a CMN (and
therefore there's an underlying cert) then the comparison could be true
if that cert had a id-pkinit-san SAN with that krb5 principal name.

I'm not sure that we actually want GSS_Compare_name() to sport such
behaviour, as opposed to having a new function that does, because it's
pushing things a bit to say that the two NAME objects passed to it are
equal representations of the same principal.  They are representations
of the same principal name, just not _equal_ representations of it.

I think I'd want a GSS_Match_name() function, or something, to embody
this kind of functionality.

Nico
-- 


_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten