Re: [TLS] Negotiation in draft-santesson-tls-gssapi

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Thu, Jul 19, 2007 at 02:35:42AM +0200, Martin Rex wrote:
> While thinking a little longer about SPNEGO a number of problems
> come to mind.
> 
> A common mechanism OID between initiator and acceptor only means
> that they will be able to parse each other GSS-API tokens,
> it does by no way mean that authentication will work.
> 
> How common is it that companies (ultimately two rival companies)
> have mutual trust configured between their company-internal
> Kerberos realms and maintain each others Kerberos principals names
> on their ACLs?

Funny, I sent an e-mail to Sam last night proposing that we talk
tomorrow (we'll be in the same city) about the identity selection
problem.

I think it'd be nice to have a way to negotiate which "federation" (to
borrow a suitable term from the world of Liberty and other identity
schemes) to use.  I picture a (forgive me) stackable pseudo-mechanism by
which the client and server can agree on a federation.  In general it
should be sufficient, and better, for the server to tell the client what
the federations are that it participates in, ASAP, so that in protocols
where there's a chance to do that before the GSS context establishment
starts then no round-trip penalty is incurred.

However, there are issues to think about.  Protecting the negotiation is
an obvious one.  Privacy protection of the client's identity(ies) is
another.

One thing that seems nice is that "federation" names can be independent
of authentication mechanisms.  A PKI, Kerberos and or Liberty federation
would be a world of domains/realms where entities (such as users and
servers) should be able to authenticate each other provided that they
have valid credentials).

Federated world negotiation is part of the identity selection problem.
Of course, the identity selection problem is still non-trivial to solve
even if we solve the federated world negotiation problem.

Nico
-- 

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls