Subject: Re: CAP: Definition of UPN

From: [email-masked]
Date: Tue, 13 Jul 1999 14:53:47 -0400

David replied in part with:
>However, in order to help create uniqueness, the last two components of 
the name *should* be your base DNS domain.

Thats do-able _IF_ and only if your authentication schema/realm has "componenets".  For 
non-DNS based systems like Notes or Netware, they may by simply "IRIS" or 
"IBMUS" or "WEBO4400", etc.  A peek at my "Network Neighborhood" reveals 
51 different  NetBIOS or other domains, none of which have any 
'components' in them.  While it is very tempting to KISS (my own mantra 
here!) and just go w/DNS names in the definition of UPN, I do not want to 
preclude building CAP over other non-DNS nameing schemas like NetBIOS, 
SPX, IrDA, etc.

The use of the "*should*" is more proper in an implementors note 
elsewhere, not in the formal definition of the UPN.  Otherwise we are 
explicitly limiting the realm to being DNS based.  I believe that there 
was agreement on this in Montreal but Im floating this now since Im not 
fortunate enough to be in Oslo to re-confirm it.

Bruce
===========================================================================
Bruce Kahn                                INet: [email-masked]
Iris Associates                          Phone: 978.392.5335
Westford, MA, USA 01886                    FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...

---

From: John Stracke <[email-masked]>
Date: Wed, 14 Jul 1999 00:07:48 +0200

[email-masked] wrote:

> >However, in order to help create uniqueness, the last two components
> of the name *should* be your base DNS domain.
>
> Thats do-able _IF_ and only if your authentication schema/realm has
> "componenets".  For non-DNS based systems like Notes or Netware, they
> may by simply "IRIS" or "IBMUS" or "WEBO4400", etc.

If you want to be able to talk to the rest of world, you need
uniqueness--period, end of statement.  (If you don't want to be able to
talk to the rest of world, you don't need to worry about the standard.
:-) What you could do to provide uniqueness is:

   * Have the admin configure their CAP software with a DNS domain that
     they control (say, example.com).
   * Have the software's UPNs use a pseudodomain such as
     IRIS.notes.example.com.
   * Whenever the software needs to look up a UPN for authentication
     purposes, it strips off the .notes.example.com to get the Notes
     domain to authenticate in.

(There, I got through the whole thing without flaming non-DNS-based name
schemes.  :-)

--
/=============================================================\
|John Stracke    | My opinions are my own | S/MIME & HTML OK  |
[email-masked]|============================================|
|Chief Scientist | NT's lack of reliability is only surpassed |
|eCal Corp.      |  by its lack of scalability. -- John Kirch |
\=============================================================/