Re: the PKU2U DN to Kerberos Principal name mapping

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Tue, Jan 29, 2008 at 12:42:35PM -0500, Jeffrey Hutzelman wrote:
> --On Monday, January 28, 2008 05:55:04 PM -0600 Nicolas Williams 
> <Nicolas.Williams at sun.com> wrote:
> 
> >I'm not sure that we actually want GSS_Compare_name() to sport such
> >behaviour, as opposed to having a new function that does, because it's
> >pushing things a bit to say that the two NAME objects passed to it are
> >equal representations of the same principal.  They are representations
> >of the same principal name, just not _equal_ representations of it.
> 
> That's OK.  GSS_Compare_name is defined to return a true result when the 
> names represent the same entity, not only when they are the same.  This 
> appears to be exactly what GSS_Compare_name is for, so no, I don't think we 
> need a new interface for this.

OK, good.  Then I think the text I gave Larry is pretty close.

I suppose we need to decide what name-types *must* be supported.  I
propose:

 - GSS_C_NT_DN (because that's what the canonical names will be based
   on!  it simply must be supported)

 - GSS_C_NT_HOSTBASED_SERVICE (because most acceptors will be hosts and
   generic GSS apps will be using this name-type)

 - GSS_KRB5_PRINCIPAL_NAME (because, PKU2U being built on PKINIT
   technology, it should be trivial to support this when id-pkinit-san
   is present)

The other name-types should all be optional.


_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten