Subject: RE: Principal for setclientid

From: "Noveck, Dave" <[email-masked]>
Date: Mon, 15 Jul 2002 08:11:45 -0700

> > I think your solution doesn't account for the case of auth-sys, which
> > while deprecated, will continue to exist in some environments.  In those
> > environments, there won't be any real principal to match and so there 
> > is a choice of having no check for misconfiguration (multiple clients
> > with the same client id), if you don't check on IP address.
> 
> The above suggests that, for Kerberos, the principal will be unique. I
> have no problem with that, but I would have used "[email-masked]"
> from all the clients in my domain, by default. Is this requirement that
> a Kerberos principal be unique per client for setclientid stated anywhere
> in the RFC? (I've currently got bis03 and will download bis04 soon, but
> admit I haven't read it all.)

I don't know of such a requirement, but I think people who are assuming
that the principal be used for this check are assuming that's the way
that clients will be configured.  Maybe they will and maybe they won't,
but the auth-sys case is clearer, using principal alone won't work.

> So, it sounds like it is still an open issue and I won't worry about it
> until it gets resolved.

You can do that but my preference would certainly be that you would help
to get it resolved, which is exactly what you are doing by your questions.

---

From: Spencer Shepler <[email-masked]>
Date: Mon, 15 Jul 2002 10:25:45 -0500

> but the auth-sys case is clearer, using principal alone won't work.

The purpose of the principal check is to offer a minor check for
denial of service.  Therefore, I don't see a problem with having all
clients in a kerberos environment use the same principal.  This will
prevent a regular kerberos authenticated user from running a user
level client and sending a matching clientid to the server and
interfering with a traditional client-kernel implementation.  The
server will use the principal to verify that the request is "valid"
for a previously registered clientid.

-- 
Spencer