Subject: "empty" names with GSS-API

From: Martin Rex <[email-masked]>
Date: Wed, 25 Nov 1998 14:28:40 +0100 (MET)

Are "empty" names (length=0) usable as names with GSS-API?
i.e. passing an empty buffer into gss_import_name() and
having gss_display_name() succeed and return an empty buffer
with the printable representation?

I recently talked to an implementor of a public key based gssapi
mechanism and their implementation was using X.500 DNs.  He mentioned
that a X.500 DN is still valid even if it doesn't contain any
components -- i.e. is displayed as an empty printable string.

Although MIT Kerberos 5 correctly imports an empty name (expanding
it by adding the default realm), gss_init_sec_context() seems to choke
when such an "empty" name is used as the target name. 

-Martin
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Douglas E. Engert" <[email-masked]>
Date: Wed, 25 Nov 1998 09:14:57 -0600

> components -- i.e. is displayed as an empty printable string.

We too have implemented a GSSAPI using the SSL protocol using SSLeay.
The names are also X.500 as the subject name of the certificate is used.
See http://www.globus.org for more details. 

I would be interested in who you spoke to, and exactly what format
they are using with the names. Maybe we could work together on this
so as to at least keep a common name format. We are currently using 
the SSLeay X509_NAME_oneline routine, which uses a format
like "/C=US/O=Globus/O=.../CN=user name" This does have some problems. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Wed, 25 Nov 1998 15:25:32 -0500

From: Martin Rex <[email-masked]>
   Date: Wed, 25 Nov 1998 14:28:40 +0100 (MET)

I would say it depends on the mechanism whether such name as any
meaning.

Well, of course:

GSS-API error initializing context: Miscellaneous failure
GSS-API error initializing context: Server not found in Kerberos database

I haven't tried it, but I'm pretty sure you could add a zero-component
principal to the Kerberos database, at which point
gss_init_sec_context() might very well work.

							- Ted