idnits 2.17.1 draft-ietf-krb-wg-kdc-model-12.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Using lowercase 'not' together with uppercase 'MUST', 'SHALL', 'SHOULD', or 'RECOMMENDED' is not an accepted usage according to RFC 2119. Please use uppercase 'NOT' together with RFC 2119 keywords (if that is what you mean). Found 'MUST not' in this paragraph: The Principal MUST not be used before this date. The syntax of the attribute MUST be Internet Date/Time Format from [RFC3339]. The attribute MUST be single-valued. == Using lowercase 'not' together with uppercase 'MUST', 'SHALL', 'SHOULD', or 'RECOMMENDED' is not an accepted usage according to RFC 2119. Please use uppercase 'NOT' together with RFC 2119 keywords (if that is what you mean). Found 'MUST not' in this paragraph: The Principal MUST not be used after this date. The syntax of the attribute MUST be Internet Date/Time Format from [RFC3339]. The attribute MUST be single-valued. -- The document seems to contain a disclaimer for pre-RFC5378 work, and may have content which was first submitted before 10 November 2008. The disclaimer is necessary when there are original authors that you have been unable to contact, or if some do not wish to grant the BCP78 rights to the IETF Trust. If you are able to get all authors (current and original) to grant those rights, you can and should remove the disclaimer; otherwise, the disclaimer is needed and you can ignore this comment. (See the Legal Provisions document at https://trustee.ietf.org/license-info for more information.) -- The document date (May 31, 2012) is 4347 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) No issues found here. Summary: 0 errors (**), 0 flaws (~~), 3 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 KERBEROS WORKING GROUP Johansson 3 Internet-Draft SUNET 4 Intended status: Standards Track May 31, 2012 5 Expires: December 2, 2012 7 An information model for Kerberos version 5 8 draft-ietf-krb-wg-kdc-model-12 10 Abstract 12 This document describes an information model for Kerberos version 5 13 from the point of view of an administrative service. There is no 14 standard for administrating a kerberos 5 KDC. This document 15 describes the services exposed by an administrative interface to a 16 KDC. 18 Status of this Memo 20 This Internet-Draft is submitted in full conformance with the 21 provisions of BCP 78 and BCP 79. 23 Internet-Drafts are working documents of the Internet Engineering 24 Task Force (IETF). Note that other groups may also distribute 25 working documents as Internet-Drafts. The list of current Internet- 26 Drafts is at http://datatracker.ietf.org/drafts/current/. 28 Internet-Drafts are draft documents valid for a maximum of six months 29 and may be updated, replaced, or obsoleted by other documents at any 30 time. It is inappropriate to use Internet-Drafts as reference 31 material or to cite them other than as "work in progress." 33 This Internet-Draft will expire on December 2, 2012. 35 Copyright Notice 37 Copyright (c) 2012 IETF Trust and the persons identified as the 38 document authors. All rights reserved. 40 This document is subject to BCP 78 and the IETF Trust's Legal 41 Provisions Relating to IETF Documents 42 (http://trustee.ietf.org/license-info) in effect on the date of 43 publication of this document. Please review these documents 44 carefully, as they describe your rights and restrictions with respect 45 to this document. Code Components extracted from this document must 46 include Simplified BSD License text as described in Section 4.e of 47 the Trust Legal Provisions and are provided without warranty as 48 described in the Simplified BSD License. 50 This document may contain material from IETF Documents or IETF 51 Contributions published or made publicly available before November 52 10, 2008. The person(s) controlling the copyright in some of this 53 material may not have granted the IETF Trust the right to allow 54 modifications of such material outside the IETF Standards Process. 55 Without obtaining an adequate license from the person(s) controlling 56 the copyright in such materials, this document may not be modified 57 outside the IETF Standards Process, and derivative works of it may 58 not be created outside the IETF Standards Process, except to format 59 it for publication as an RFC or to translate it into languages other 60 than English. 62 Table of Contents 64 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 65 2. Requirements notation . . . . . . . . . . . . . . . . . . . . 4 66 3. Information model demarcation . . . . . . . . . . . . . . . . 5 67 4. Information model specification . . . . . . . . . . . . . . . 6 68 4.1. Principal . . . . . . . . . . . . . . . . . . . . . . . . 6 69 4.1.1. Principal: Attributes . . . . . . . . . . . . . . . . 6 70 4.1.2. Principal: Associations . . . . . . . . . . . . . . . 8 71 4.2. KeySet . . . . . . . . . . . . . . . . . . . . . . . . . . 8 72 4.2.1. KeySet: Attributes . . . . . . . . . . . . . . . . . . 9 73 4.2.2. KeySet: Associations . . . . . . . . . . . . . . . . . 9 74 4.3. Key . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 75 4.3.1. Key: Attributes . . . . . . . . . . . . . . . . . . . 9 76 4.3.2. Key: Associations . . . . . . . . . . . . . . . . . . 10 77 4.3.3. Key: Remarks . . . . . . . . . . . . . . . . . . . . . 10 78 4.4. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 10 79 4.4.1. Policy: Attributes . . . . . . . . . . . . . . . . . . 10 80 4.4.2. Mandatory-to-implement Policy . . . . . . . . . . . . 11 81 5. Implementation Scenarios . . . . . . . . . . . . . . . . . . . 13 82 5.1. LDAP backend to KDC . . . . . . . . . . . . . . . . . . . 13 83 5.2. LDAP frontend to KDC . . . . . . . . . . . . . . . . . . . 13 84 5.3. SOAP . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 85 5.4. Netconf . . . . . . . . . . . . . . . . . . . . . . . . . 13 86 6. Security Considerations . . . . . . . . . . . . . . . . . . . 14 87 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 88 8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 89 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17 90 9.1. Normative References . . . . . . . . . . . . . . . . . . . 17 91 9.2. Informative References . . . . . . . . . . . . . . . . . . 17 92 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 18 94 1. Introduction 96 The Kerberos version 5 authentication service described in [RFC4120] 97 describes how a Key Distribution Center (KDC) provides authentication 98 to clients. The standard does not stipulate how a KDC is managed and 99 several "kadmin" servers have evolved. This document describes the 100 services required to administer a KDC and the underlying information 101 model assumed by a kadmin-type service. 103 The information model is written in terms of "attributes" and 104 "services" or "interfaces" but the use of these particular words must 105 not be taken to imply any particular modeling paradigm. Neither an 106 object oriented model nor an LDAP schema is intended. The author has 107 attempted to describe in natural language the intended semantics and 108 syntax of the components of the model. An LDAP schema (for instance) 109 based on this model will be more precise in the expression of the 110 syntax while preserving the semantics of this model. 112 Implementations of this document MAY decide to change the names used 113 (e.g. principalName). If so an implementation MUST provide a name to 114 name mapping to this document. In particular schema languages may 115 have different conventions for caseing, eg camelCase vs use of '_' 116 and '-' to separate 'words' in a name. Implementations MUST call out 117 such conventions explicitly. 119 Implementations of this document MUST be able to support default 120 values for attributes as well as the ability to specify syntax for 121 attribute values. 123 2. Requirements notation 125 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 126 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 127 document are to be interpreted as described in [RFC2119]. 129 This document describes an information model for kerberos 5 but does 130 not directly describe any mapping onto a particular schema- or 131 modelling language. Hence an implementation of this model consists 132 of a mapping to such a language - e.g. an LDAP or SQL schema. The 133 precise interpretation of terms from [RFC2119] therefore require some 134 extra explanation. 136 The terms MUST or REQUIRED means that schema implementing this model 137 must have a way to represent the feature (i.e that it is mandatory to 138 implement) but that unless otherwise specified the feature may 139 represent an optional element in the chosen schema definition 140 language. 142 However MUST also means that a KDC or administrative interface 143 implementing this information model MUST provide the feature and 144 associated behavior consistent with schema. 146 For instance, principalLastFailedAuthentication (cf below) represents 147 the last time an authentication failed for a principal. In an LDAP 148 schema (for instance) this may be represented as an optional 149 attribute even though all KDCs implementing this specification must 150 support this attribute. 152 The terms MAY or OPTIONAL means that the feature is optional to 153 implement by a KDC or administrative interface implementing this 154 information model. MAY also means that the feature is optional to 155 implement in schema. 157 Implementors of schema should be aware that unless there is a way to 158 represent critical but optional elements in the schema definition 159 language confusion may arise when optional elements are used but not 160 understood by all implementations in a particular deployment. 162 3. Information model demarcation 164 The information model specified in the next chapter describes 165 objects, properties of those objects and relations between those 166 objects. These elements comprise an abstract view of the data 167 represented in a KDC. It is important to understand that the 168 information model is not a schema. In particular the way objects are 169 compared for equality beyond that which is implied by the 170 specification of a syntax is not part of this specification. Nor is 171 ordering specified between elements of a particular syntax. 173 Further work on Kerberos will undoubtedly prompt updates to this 174 information model to reflect changes in the functions performed by 175 the KDC. Such extensions to the information model should always use 176 a normative reference to the relevant RFCs detailing the change in 177 KDC function. 179 This model describes a number of elements related to password policy 180 management. Not all of the elements in this model are unique to 181 Kerberos; an LDAP implementation of this model should incorporate 182 existing LDAP schema where functional overlap exists, rather than 183 defining additional Kerberos-specific elements. 185 4. Information model specification 187 4.1. Principal 189 The fundamental entity stored in a KDC is the principal. The 190 Principal is associated to keys and generalizes the "user" concept. 191 The Principal MUST be implemented in full and MUST NOT be OPTIONAL in 192 an implementation 194 4.1.1. Principal: Attributes 196 4.1.1.1. principalName 198 The principalName MUST uniquely identify the Principal within the 199 administrative context of the KDC. The principalName MUST be 200 equivalent to the string representation of the Principal name 201 (section 2.1.1 of [RFC1964]) including, if applicable for the name 202 type, the realm. 204 The attribute MAY be multi-valued if the implementation supports 205 aliases and/or enterprise names. In that case exactly one of the 206 principalName values MAY be designated the canonical principalName 207 and if the implementation supports enctypes which require salt then 208 exactly one of the values of principalName MAY be designated as the 209 canonical salting principalName. 211 Implementations (i.e. schema) that support enterprise names and/or 212 aliases SHOULD provide for efficient lookup of Principal objects 213 based on alias/enterprise name. 215 4.1.1.2. principalNotUsedBefore 217 The Principal MUST not be used before this date. The syntax of the 218 attribute MUST be Internet Date/Time Format from [RFC3339]. The 219 attribute MUST be single-valued. 221 4.1.1.3. principalNotUsedAfter 223 The Principal MUST not be used after this date. The syntax of the 224 attribute MUST be Internet Date/Time Format from [RFC3339]. The 225 attribute MUST be single-valued. 227 4.1.1.4. principalIsDisabled 229 A boolean attribute used to disable a Principal. The attribute 230 SHOULD default to boolean FALSE. 232 4.1.1.5. principalNumberOfFailedAuthenticationAttempts 234 This single-valued integer attribute contains a count of the number 235 of times an authentication attempt was unsuccessful for this 236 Principal. Implementations SHOULD NOT allow this counter to be 237 reset. 239 4.1.1.6. principalLastFailedAuthentication 241 This single-valued attribute contains the time and date for the last 242 failed authentication attempt for this Principal. The syntax of the 243 attribute MUST be Internet Date/Time Format from [RFC3339]. 245 4.1.1.7. principalLastSuccessfulAuthentication 247 This single-valued attribute contains the time and date for the last 248 successful authentication attempt for this principal. The syntax of 249 the attribute MUST be Internet Date/Time Format from [RFC3339]. 251 4.1.1.8. principalLastCredentialChangeTime 253 This single-valued attribute contains the time of the last successful 254 change of credential (e.g. password or private key) associated with 255 this Principal. The syntax of the attribute MUST be Internet Date/ 256 Time Format from [RFC3339]. 258 4.1.1.9. principalCreateTime 260 This single-valued attribute contains the time and date when this 261 Principal was created. The syntax of the attribute MUST be Internet 262 Date/Time Format from [RFC3339]. 264 4.1.1.10. principalModifyTime 266 This single-valued attribute contains the time and date when this 267 Principal was last modified excluding credentials change. The syntax 268 of the attribute MUST be Internet Date/Time Format from [RFC3339]. 270 4.1.1.11. principalMaximumTicketLifetime 272 This single-valued attribute contains the time in seconds 273 representing the maximum lifetime for tickets issued for this 274 Principal. 276 4.1.1.12. principalMaximumRenewableTicketLifetime 278 This single-valued attribute contains the delta time in seconds 279 representing the maximum amount of time a ticket may be renewed for 280 this Principal. 282 4.1.1.13. principalAllowedEnctype 284 This OPTIONAL multi-valued attribute lists the enctypes allowed for 285 this principal. If empty or absent any enctype supported by the 286 implementation is allowed for this Principal. 288 This attribute is intended as a policy attribute and restricts all 289 uses of enctypes including server, client, and session keys. Data 290 models MAY choose to use policy objects in order to represent more 291 complex decision mechanisms. 293 4.1.2. Principal: Associations 295 Each Principal MAY be associated with 0 or more KeySet and MAY be 296 associated with 0 or more Policies. The KeySet is represented as an 297 object in this model since it has attributes associated with it (the 298 key version number). In typical situations the Principal is 299 associated with exactly 1 KeySet but implementations MUST NOT assume 300 this case, i.e. an implementation of this standard MUST be able to 301 handle the general case of multiple KeySet associated with each 302 principal. Multiple KeySets may for instance be useful when 303 performing a key rollover for a principal. 305 4.2. KeySet 307 In Kerberos principals are associated with zero or more symmetric 308 secret keys, and each key has a key version number (kvno) and 309 enctype. In this model we group keys by kvno into KeySet objects. A 310 Principal can have zero or more KeySet objects associated with it, 311 each of which MUST have one or more keys. Each KeySet is associated 312 with exactly one principal. Schemas derived from this model MAY lack 313 a direct analogue of KeySet as described in this document. 315 It is expected that most Kerberos implementations will use a special- 316 purpose interface for setting and changing Principal passwords and 317 keys. 319 If a server supports an enctype for a Principal that enctype must be 320 present in at least one key for the Principal in question. For any 321 given enctype a KeySet MUST NOT contain more than one Key with that 322 enctype. 324 The security of Kerberos 5 depends absolutely on the confidentiality 325 and integrity of the Key objects stored in the KDC. Implementations 326 of this standard MUST facilitate, to the extent possible, an 327 administrator's ability to place more restrictive access controls on 328 KeySets than on other Principal data, and to arrange for more secure 329 backup for KeySets. 331 4.2.1. KeySet: Attributes 333 4.2.1.1. kvno 335 Also knowns as the key version number. This is a single-valued 336 attribute containing a non-negative integer. This number is 337 incremembed by one each time a key in the KeySet is changed. 339 4.2.2. KeySet: Associations 341 To each KeySet MUST be associated a set of 1 or more Keys. 343 4.3. Key 345 Implementations of this model MUST NOT REQUIRE keys to be 346 represented. 348 4.3.1. Key: Attributes 350 4.3.1.1. keyEncryptionType 352 The enctype SHOULD be represented as an enumeration of the enctypes 353 supported by the KDC using the string name ("encryption type") of the 354 enctype from the IANA registry of Kerberos Encryption Type Numbers. 355 One example is 'aes128-cts-hmac-sha1-96'. 357 4.3.1.2. keyValue 359 The binary representation of the key data. This MUST be a single- 360 valued octet string. 362 4.3.1.3. keySaltValue 364 The binary representation of the key salt. This MUST be a single- 365 valued octet string. 367 4.3.1.4. keyStringToKeyParameter 369 This MUST be a single-valued octet string representing an opaque 370 parameter associated with the enctype. This parameter is specified 371 in the "string-to-key" method in section 3 of [RFC3961]. 373 4.3.1.5. keyNotUsedBefore 375 This key MUST NOT be used before this date. The syntax of the 376 attribute MUST be semantically equivalent with the standard ISO date 377 format. This MUST be a single-valued attribute. 379 4.3.1.6. keyNotUsedAfter 381 This key MUST NOT be used after this date. The syntax of the 382 attribute MUST be semantically equivalent with the standard ISO date 383 format. This MUST be a single-valued attribute. 385 4.3.1.7. keyIsDisabled 387 This is a boolean attribute which SHOULD be set to false by default. 388 If this attribute is true the key MUST NOT be used. This is used to 389 temporarily disable a key. 391 4.3.2. Key: Associations 393 None 395 4.3.3. Key: Remarks 397 The security of the keys is an absolute requirement for the operation 398 of Kerberos 5. If keys are implemented adequate protection from 399 unauthorized modification and disclosure MUST be available and 400 REQUIRED by the implementation. 402 4.4. Policy 404 Implementations SHOULD implement policy but MAY allow them to be 405 OPTIONAL. The Policy should be thought of as a 'typed hole'. i.e. an 406 opaque binary value paired with an identifier of type of data 407 contained in the binary value. Both attributes (type and value) must 408 be present. 410 4.4.1. Policy: Attributes 412 4.4.1.1. policyIdentifier 414 The policyIdentifier MUST be globally unique. Possible types of 415 identifiers include: 417 An Object Identifier (OID) 419 A URI 420 A UUID 422 The use of OIDs is RECOMMENDED for this purpose. 424 4.4.1.2. policyIsCritical 426 This boolean attribute indicates that the KDC MUST be able to 427 correctly interpret and apply this policy for the Principal to be 428 used. 430 4.4.1.3. policyContent 432 This is an optional single opaque binary value used to store a 433 representation of the policy. In general a policy cannot be fully 434 expressed using attribute-value pairs. The policyContent is OPTIONAL 435 in the sense that an implementation MAY use it to store an opaque 436 value for those policy-types which are not directly representable in 437 that implementation. 439 4.4.1.4. policyUse 441 This is an optional single enumerated string value used to describe 442 the use of the policy. Implementations SHOULD provide this attribute 443 and MUST (if the attribute is implemented) describe the enumerated 444 set of possible values. The intent is that this attribute be useful 445 in providing an initial context-based filtering. 447 4.4.2. Mandatory-to-implement Policy 449 All implementations that represent Policy objects MUST be able to 450 represent the policies listed in this section. Implementations are 451 not required to use the same underlying data-representation for the 452 policyContent binary value but SHOULD use the same OIDs as the 453 policyIdentifier. In general the expression of policy may require a 454 Turing-complete language. This specification does not attempt to 455 model policy expression language. 457 4.4.2.1. Password Quality Policy 459 Password quality policy controls the requirements placed by the KDC 460 on new passwords. This policy SHOULD be identified by the OID 461 .1. 463 4.4.2.2. Password Management Policy 465 Password management policy controls how passwords are changed. This 466 policy SHOULD be identified by the OID .2. 468 4.4.2.3. Keying Policy 470 A keying policy specifies the association of enctypes with new 471 principals, e.g. when a Principal is created one of the applicable 472 keying policies is used to determine the set of keys to associate 473 with the principal. This policy SHOULD be identified by the OID 474 .3. 476 4.4.2.4. Ticket Flag Policy 478 A ticket flag policy specifies the ticket flags allowed for tickets 479 issued for a principal. This policy SHOULD be identified by the OID 480 .4. 482 5. Implementation Scenarios 484 There are several ways to implement an administrative service for 485 Kerberos 5 based on this information model. In this section we list 486 a few of them. 488 5.1. LDAP backend to KDC 490 Given an LDAP schema implementation of this information model it 491 would be possible to build an administrative service by back-ending 492 the KDC to a directory server where principals and keys are stored. 493 Using the security mechanisms available on the directory server keys 494 are protected from access by anyone apart from the KDC. 495 Administration of the principals, policy, and other non-key data is 496 done through the directory server while the keys are modified using 497 the set/change password protocol 498 [I-D.ietf-krb-wg-kerberos-set-passwd]. 500 5.2. LDAP frontend to KDC 502 An alternative way to provide a directory interface to the KDC is to 503 implement an LDAP-frontend to the KDC which exposes all non-key 504 objects as entries and attributes. As in the example above all keys 505 are modified using the set/change password protocol 506 [I-D.ietf-krb-wg-kerberos-set-passwd]. In this scenario the 507 implementation would typically not use a traditional LDAP 508 implementation but treat LDAP as an access protocol to data in the 509 native KDC database. 511 5.3. SOAP 513 Given an XML schema implementation of this information model it would 514 be possible to build a SOAP interface to the KDC. This demonstrates 515 the value of creating an abstract information model which is mappable 516 to multiple schema representations. 518 5.4. Netconf 520 Given a YAML implementation of this information model it would be 521 possible to create a Netconf-based interface to the KDC, enabling 522 management of the KDC from standard network management applications. 524 6. Security Considerations 526 This document describes an abstract information model for Kerberos 5. 527 The Kerberos 5 protocol depends on the security of the keys stored in 528 the KDC. The model described here assumes that keys MUST NOT be 529 transported in the clear over the network and furthermore that keys 530 are treated as write-only attributes that SHALL only be modified 531 (using the administrative interface) by the change-password protocol 532 [I-D.ietf-krb-wg-kerberos-set-passwd]. 534 Exposing the object model of a KDC typically implies that objects can 535 be modified and/or deleted. In a KDC not all principals are created 536 equal, so that for instance deleting krbtgt/EXAMPLE.COM@EXAMPLE.COM 537 effectively disables the EXAMPLE.COM realm. Hence access control is 538 paramount to the security of any implementation. This document does 539 not mandate access control. This only implies that access control is 540 beyond the scope of the standard information model, i.e. that access 541 control may not be accessible via any protocol based on this model. 542 If access control objects are exposed via an extension to this model 543 the presence of access control may in itself provide points of attack 544 by giving away information about principals with elevated rights etc. 546 7. IANA Considerations 548 This document requires the allocation of several OIDs marked in 549 section 4.4.2 above. IANA should allocate a new arc under 550 1.3.6.1.5.2.5 (iso.org.dod.internet.security.kerberosV5.policies) 551 named "kdcPolicy" and assign each of the policy OIDs a new number 552 under this arc. 554 8. Acknowledgments 556 The author wishes to extend his thanks to Love Hoernquist-Aestrand 557 and Sam Hartman for their important 558 contributions to this document. 560 9. References 562 9.1. Normative References 564 [RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", 565 RFC 1964, June 1996. 567 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 568 Requirement Levels", BCP 14, RFC 2119, March 1997. 570 [RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the 571 Internet: Timestamps", RFC 3339, July 2002. 573 [RFC3961] Raeburn, K., "Encryption and Checksum Specifications for 574 Kerberos 5", RFC 3961, February 2005. 576 [RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The 577 Kerberos Network Authentication Service (V5)", RFC 4120, 578 July 2005. 580 9.2. Informative References 582 [I-D.ietf-krb-wg-kerberos-set-passwd] 583 Williams, N., "Kerberos Set/Change Key/Password Protocol 584 Version 2", draft-ietf-krb-wg-kerberos-set-passwd-08 (work 585 in progress), November 2008. 587 Author's Address 589 Leif Johansson 590 Swedish University Network 591 Thulegatan 11 592 Stockholm 594 Email: leifj@sunet.se 595 URI: http://www.sunet.se