Subject: Re: CAP: Definition of UPN

From: Harald Alvestrand <[email-masked]>
Date: Fri, 16 Jul 1999 10:54:58 +0200

At 02:02 16.07.99 +0000, rans(a)netscape.com"@DMZ.maxware.no wrote:
>Bruce,
>
>Your notes are partially correct. My notes said we agreed on the SHOULD,
>e.g., something like "A realm SHOULD incorporate a registered DNS domain
>name as a suffix to guarantee uniqueness of realm names across the
>Internet.". We decided not to use the MUST because of the proliferation
>of non-DNS name spaces in environments that don't require their CUA's to
>reference users outside a domain. We also said that a UPN:
>
>    * MUST use the @ character as a separator between a username and
>      realm
>    * MUST allow for all UTF8 characters
>    * MUST be case insensitive
>    * MUST be unique within a realm
>    * MUST be unique within connected CUA's and CS's
>    * MUST be independent of an authentication mechanism
>    * MUST represent the same CU, whether using the same CUA or using
>      different authenticating mechanisms or connecting from different
>      locations

Just a cross-area note:

You might want to pick up RFC 2486, "The Network Access Identifier", which 
has a very similar set of requirements.

It might be simpler to say that an UPN is like an NAI, except for.....
(the main difference I see is the requirement for UTF-8 in the username).

                     Harald

Note: Mainly offline until August 8.

--
Harald Tveit Alvestrand, Maxware, Norway
[email-masked]

---

From: [email-masked]
Date: Sun, 18 Jul 1999 17:41:33 GMT

This is a great idea. Thanks for the pointer to the RFC.  Richard, since 
you are going to be working on the wording of this portion, can you please 
take on the assignment to go look at this RFC? I appreciate it.

Harald Alvestrand <[email-masked]>
Sent by: [email-masked]
07/16/99 04:54 AM

        To:     [email-masked]
        cc: 
        Subject:        Re: CAP: Definition of UPN

Just a cross-area note:

                     Harald

---

From: [email-masked]
Date: Mon, 19 Jul 1999 11:48:09 -0400

>has a very similar set of requirements.

A very interesting quick read.  I would also recommend it to others for a 
quick scan.  However I did notice one glitch in the BNF used:

   nai         = username / ( username "@" realm )

   username    = dot-string

   realm       = realm "." label

   label       = let-dig * (ldh-str)

The definition of realm is infinitely recursive. It has no 'terminal only' 
state like:

   dot-string  = string / ( dot-string "." string )

   string      = char / ( string char )

Dont know if this was a glitch in the publishing process or if no 
reviewers found it.

Harald:  What is the process to get this 'fixed'?

Bruce
===========================================================================
Bruce Kahn                                INet: [email-masked]
Iris Associates                          Phone: 978.392.5335
Westford, MA, USA 01886                    FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...