idnits 2.17.1 draft-ietf-kitten-gssapi-store-cred-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- ** It looks like you're using RFC 3978 boilerplate. You should update this to the boilerplate described in the IETF Trust License Policy document (see https://trustee.ietf.org/license-info), which is required now. -- Found old boilerplate from RFC 3978, Section 5.1 on line 15. -- Found old boilerplate from RFC 3978, Section 5.5 on line 302. -- Found old boilerplate from RFC 3979, Section 5, paragraph 1 on line 313. -- Found old boilerplate from RFC 3979, Section 5, paragraph 2 on line 320. -- Found old boilerplate from RFC 3979, Section 5, paragraph 3 on line 326. ** This document has an original RFC 3978 Section 5.4 Copyright Line, instead of the newer IETF Trust Copyright according to RFC 4748. ** This document has an original RFC 3978 Section 5.5 Disclaimer, instead of the newer disclaimer which includes the IETF Trust according to RFC 4748. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the RFC 3978 Section 5.4 Copyright Line does not match the current year -- The document seems to lack a disclaimer for pre-RFC5378 work, but may have content which was first submitted before 10 November 2008. If you have contacted all the original authors and they are all willing to grant the BCP78 rights to the IETF Trust, then this is fine, and you can ignore this comment. If not, you may need to add the pre-RFC5378 disclaimer. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (October 19, 2006) is 6399 days in the past. Is this intentional? -- Found something which looks like a code comment -- if you have code sections in the document, please surround them with '' and '' lines. Checking references for intended status: Informational ---------------------------------------------------------------------------- No issues found here. Summary: 4 errors (**), 0 flaws (~~), 1 warning (==), 8 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 NETWORK WORKING GROUP N. Williams 3 Internet-Draft Sun 4 Intended status: Informational October 19, 2006 5 Expires: April 22, 2007 7 GSS-API Extension for Storing Delegated Credentials 8 draft-ietf-kitten-gssapi-store-cred-02.txt 10 Status of this Memo 12 By submitting this Internet-Draft, each author represents that any 13 applicable patent or other IPR claims of which he or she is aware 14 have been or will be disclosed, and any of which he or she becomes 15 aware will be disclosed, in accordance with Section 6 of BCP 79. 17 Internet-Drafts are working documents of the Internet Engineering 18 Task Force (IETF), its areas, and its working groups. Note that 19 other groups may also distribute working documents as Internet- 20 Drafts. 22 Internet-Drafts are draft documents valid for a maximum of six months 23 and may be updated, replaced, or obsoleted by other documents at any 24 time. It is inappropriate to use Internet-Drafts as reference 25 material or to cite them other than as "work in progress." 27 The list of current Internet-Drafts can be accessed at 28 http://www.ietf.org/ietf/1id-abstracts.txt. 30 The list of Internet-Draft Shadow Directories can be accessed at 31 http://www.ietf.org/shadow.html. 33 This Internet-Draft will expire on April 22, 2007. 35 Copyright Notice 37 Copyright (C) The Internet Society (2006). 39 Abstract 41 This document defines a new function for the GSS-API which allows 42 applications to store delegated (and other) credentials in the 43 implicit GSS-API credential store. This is needed for GSS-API 44 applications to use delegated credentials as they would use other 45 credentials. 47 Table of Contents 49 1. Conventions used in this document . . . . . . . . . . . . . . 3 50 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 51 3. GSS_Store_cred() . . . . . . . . . . . . . . . . . . . . . . . 5 52 4. C-Bindings . . . . . . . . . . . . . . . . . . . . . . . . . . 7 53 5. Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 54 6. Security considerations . . . . . . . . . . . . . . . . . . . 9 55 7. Normative References . . . . . . . . . . . . . . . . . . . . . 10 56 Author's Address . . . . . . . . . . . . . . . . . . . . . . . 11 57 Intellectual Property and Copyright Statements . . . . . . . . 12 59 1. Conventions used in this document 61 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 62 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 63 document are to be interpreted as described in [RFC2119]. 65 2. Introduction 67 The GSS-API [RFC2743] clearly assumes that credentials exist in an 68 implicit store whence they can be acquired using GSS_Acquire_cred() 69 and GSS_Add_cred() or through use of the default credential. 70 Multiple credential stores may exist on a given host, but only one 71 store may be accessed by GSS_Acquire_cred() and GSS_Add_cred() at any 72 given time. 74 This assumption can be seen in sections 1.1.1.2 and 1.1.1.3 of 75 [RFC2743] as well as in section 3.5 of [RFC2744]. 77 Applications may be able to change the credential store from which 78 credentials can be acquired, either by changing user contexts (where 79 the applications have the privilege to do so) or by other means 80 (where a user may have multiple credential stores). 82 Some GSS-API acceptor applications always change user contexts, after 83 accepting a GSS-API security context and making appropriate 84 authorization checks, to the user context corresponding to the 85 initiator principal name or to a context requested by the initiator. 86 The means by which credential stores are managed are generally beyond 87 the scope of the GSS-API. 89 In the case of delegated credential handles however, such credentials 90 do not exist in the acceptor's credential store or in the credential 91 stores of the user contexts to which the acceptor application might 92 change. The GSS-API provides no mechanism by which delegated 93 credential handles can be made available for acquisition through 94 GSS_Acquire_cred()/GSS_Add_cred(). The GSS-API also does not provide 95 any credential import/export interfaces like the GSS-API context 96 import/export interfaces. 98 Thus acceptors are limited to making only direct use of delegated 99 credential handles and only with GSS_Init_sec_context(), 100 GSS_Inquire_cred*() and GSS_Release_cred(). This limitation is 101 particularly onerous on Unix systems where a call to exec() to 102 replace the process image obliterates any delegated credentials 103 handle that may exist in that process. 105 In order to make delegated credentials generally as useful as 106 credentials that can be acquired with GSS_Acquire_cred() and 107 GSS_Add_cred() a primitive is needed which allows storing of 108 credentials in the implicit credential store. This primitive we call 109 "GSS_Store_cred()." 111 3. GSS_Store_cred() 113 Inputs: 115 o input_cred_handle CREDENTIAL HANDLE, -- credential to store; MUST 116 NOT be GSS_C_NO_CREDENTIAL 118 o cred_usage INTEGER -- 0=INITIATE-AND-ACCEPT, 1=INITIATE-ONLY, 119 2=ACCEPT-ONLY 121 o desired_mech_element OBJECT IDENTIFIER, -- if GSS_C_NULL_OID then 122 store all the elements of the input_cred_handle, otherwise store 123 only the element of the corresponding mechanism 125 o overwrite_cred BOOLEAN, -- if TRUE replace any credential for the 126 same principal in the credential store 128 o default_cred BOOLEAN -- if TRUE make the stored credential 129 available as the default credential (for acquisition with 130 GSS_C_NO_NAME as the desired name or for use as 131 GSS_C_NO_CREDENTIAL) 133 Outputs: 135 o major_status INTEGER, 137 o minor_status INTEGER, 139 o mech_elements_stored SET OF OBJECT IDENTIFIER, -- the set of 140 mechanism OIDs for which credential elements were successfully 141 stored 143 o cred_usage_stored INTEGER -- like cred_usage, but indicates what 144 kind of credential was stored (useful when the cred_usage input 145 parameter is set to INITIATE-AND-ACCEPT) 147 Return major_status codes: 149 o GSS_S_COMPLETE indicates that the credentials were successfully 150 stored. 152 o GSS_S_CREDENTIALS_EXPIRED indicates that the input credentials had 153 expired or expired before they could be stored. 155 o GSS_S_NO_CRED indicates that no input credentials were given. 157 o GSS_S_UNAVAILABLE indicates that the credential store is not 158 available. 160 o GSS_S_DUPLICATE_ELEMENT indicates that an element of the input 161 credential could not be stored because a credential for the same 162 principal exists in the current credential store and the 163 overwrite_cred input argument was FALSE. 165 o GSS_S_FAILURE indicates that the credential could not be stored 166 for some other reason. The minor status code may provide more 167 information if a non-GSS_C_NULL_OID desired_mech_element was 168 given. 170 GSS_Store_cred() is used to store, in the current credential store, a 171 given credential that has either been acquired from a different 172 credential store or been accepted as a delegated credential. 174 Specific mechanism elements of a credential can be stored one at a 175 time by specifying a non-GSS_C_NULL_OID mechanism OID as the 176 desired_mech_element input argument, in which case the minor status 177 output SHOULD have a mechanism-specific value when the major status 178 is not GSS_S_COMPLETE. 180 The initiator, acceptor or both usages of the input credential may be 181 stored as per the cred_usage input argument. 183 The credential elements that were actually stored, when the major 184 status is GSS_S_COMPLETE, are indicated through the cred_usage_stored 185 and mech_elements_stored function outputs. 187 If credentials already exist in the current store for the principal 188 of the input_cred_handle, then those credentials are not replaced 189 with the input credentials unless the overwrite_cred input argument 190 is TRUE. 192 Finally, if the current credential store has no default credential 193 (that is, no credential that could be acquired for GSS_C_NO_NAME) or 194 if the default_cred input argument is TRUE, and the input credential 195 can be successfully stored, then the input credential will be 196 available for acquisition with GSS_C_NO_NAME as the desired name 197 input to GSS_Acquire_cred() or GSS_Add_cred() as well as for use as 198 GSS_C_NO_CREDENTIAL for the cred_handle inputs to GSS_Inquire_cred(), 199 GSS_Inquire_cred_by_mech(), GSS_Init_sec_context() and 200 GSS_Accept_sec_context(). 202 4. C-Bindings 204 The C-bindings for GSS_Store_cred() make use of types from and are 205 designed based on the style of the GSS-APIv2 C-Bindings [RFC2744]. 207 OM_uint32 gss_store_cred( 208 OM_uint32 *minor_status, 209 gss_cred_id_t input_cred_handle, 210 gss_cred_usage_t cred_usage, 211 const gss_OID desired_mech, 212 OM_uint32 overwrite_cred, 213 OM_uint32 default_cred, 214 gss_OID_set *elements_stored, 215 gss_cred_usage_t *cred_usage_stored) 217 Figure 1 219 The two boolean arguments, 'overwrite_cred' and 'default_cred' are 220 typed as OM_uint32; 0 corresponds to FALSE, non-zero values 221 correspond to TRUE. 223 5. Examples 225 The intended usage of GSS_Store_cred() is to make delegated 226 credentials available to child processes of GSS-API acceptor 227 applications. Example pseudo-code: 229 /* 230 * 233 * 234 * <"requested_username" is a username derived from the 235 * initiator name or explicitly requested by the initiator 236 * application.> 237 */ 238 ... 240 if (authorize_gss_client(src_name, requested_username)) { 241 /* 242 * For Unix-type platforms this may mean calling setuid() and 243 * it may or may not also mean setting/unsetting such 244 * environment variables as KRB5CCNAME and what not -- all 245 * OS-specific details. 246 */ 247 if (change_user_context(requested_username)) 248 (void) gss_store_creds(&minor_status, deleg_cred, 249 GSS_C_INITIATE, actual_mech, 250 0, 1, NULL, NULL); 251 } 252 else ... 253 } 254 else ... 256 6. Security considerations 258 Acceptor applications MUST only store delegated credentials into 259 appropriate credential stores and only after proper authorization of 260 the authenticated initiator principal to the requested service(s). 262 Acceptor applications that have no use for delegated credentials MUST 263 release them (such acceptor applications that use the GSS-API 264 C-Bindings may simply provide a NULL value for the 265 delegated_cred_handle argument to gss_accept_sec_context()). 267 7. Normative References 269 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 270 Requirement Levels", BCP 14, RFC 2119, March 1997. 272 [RFC2743] Linn, J., "Generic Security Service Application Program 273 Interface Version 2, Update 1", RFC 2743, January 2000. 275 [RFC2744] Wray, J., "Generic Security Service API Version 2 : 276 C-bindings", RFC 2744, January 2000. 278 Author's Address 280 Nicolas Williams 281 Sun Microsystems 282 5300 Riata Trace Ct 283 Austin, TX 78727 284 US 286 Email: Nicolas.Williams@sun.com 288 Full Copyright Statement 290 Copyright (C) The Internet Society (2006). 292 This document is subject to the rights, licenses and restrictions 293 contained in BCP 78, and except as set forth therein, the authors 294 retain all their rights. 296 This document and the information contained herein are provided on an 297 "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 298 OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET 299 ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, 300 INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE 301 INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 302 WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 304 Intellectual Property 306 The IETF takes no position regarding the validity or scope of any 307 Intellectual Property Rights or other rights that might be claimed to 308 pertain to the implementation or use of the technology described in 309 this document or the extent to which any license under such rights 310 might or might not be available; nor does it represent that it has 311 made any independent effort to identify any such rights. Information 312 on the procedures with respect to rights in RFC documents can be 313 found in BCP 78 and BCP 79. 315 Copies of IPR disclosures made to the IETF Secretariat and any 316 assurances of licenses to be made available, or the result of an 317 attempt made to obtain a general license or permission for the use of 318 such proprietary rights by implementers or users of this 319 specification can be obtained from the IETF on-line IPR repository at 320 http://www.ietf.org/ipr. 322 The IETF invites any interested party to bring to its attention any 323 copyrights, patents or patent applications, or other proprietary 324 rights that may cover technology that may be required to implement 325 this standard. Please address the information to the IETF at 326 ietf-ipr@ietf.org. 328 Acknowledgment 330 Funding for the RFC Editor function is provided by the IETF 331 Administrative Support Activity (IASA).