Subject: Re: Soliciting additional GSS/Kerberos interoperability results

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 10 May 2001 13:04:17 -0500

"Linn, John" wrote:
> 
> Kerberos WG:
> 
> This will be familiar news for those also subscribing to the CAT-WG mailing
> list, but I'd like to point out to others in the Kerberos community that
> we're looking for interoperability testing results which could support
> advancement of the GSS-API RFCs (2743, and 2744 and/or 2853) to Draft
> Standards.  We've some results already reported, but could use more.

If its 2743 and 2744 you would like to move along, then you must also be interested
 in GSS mechanisms other then Kerberos and how they could be written to use these 
RFCs. The Globus GSI  which implements a GSS using PKI and SSL is one example.
See: http://www.globus.org 

As we pointed out at the last IETF, we wished that there where a few additions
to the RFCs, but did not find any problems with the current RFCs themselves. 

As an interoperability example, the Globus applications (including ssh and ftp) are
written to work with either the GSI or the Kerberos mechanisms. This choice can be made
at link time. When using the ssh client, SecureCRT, on Windows, the choice can be made
at run time via a DLL. (If the mechglue was working for UNIX, UNIX could make the choice
at run time too.) 

So I would say that these RFCs are in good shape, and could move forward. 

> Recognizing that several Kerberos-based GSS implementations exist, I'd like
> to solicit any summaries which their keepers can provide concerning the
> scope of testing undertaken, other implementations that have been tested
> against, and particularly the sets of GSS-selectable features which were
> exercised in testing.  Please send any results you can offer either to the
> CAT-WG list at [email-masked], or to me as CAT-WG chair.
> Thanks for any support you can provide in this effort.
> 
> --jl

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "John Brezak" <[email-masked]>
Date: Thu, 10 May 2001 11:26:21 -0700

There appears to be an issue with gss_canonicalize_name when used with
Kerberos. If a middle tier server has multiple principals (as is
currently the case with Kerberos), how can gss_canonicalize name be used
in its described way for building a canonical name for that middle-tier
server that can be stored on ACLs?

-----Original Message-----
From: Douglas E. Engert [mailto:[email-masked]] 
Sent: Thursday, May 10, 2001 11:04 AM
To: Linn, John
Cc: [email-masked]'; 'CAT-WG List'
Subject: Re: Soliciting additional GSS/Kerberos interoperability results

"Linn, John" wrote:
> 
> Kerberos WG:
> 
> This will be familiar news for those also subscribing to the CAT-WG 
> mailing list, but I'd like to point out to others in the Kerberos 
> community that we're looking for interoperability testing results 
> which could support advancement of the GSS-API RFCs (2743, and 2744 
> and/or 2853) to Draft Standards.  We've some results already reported,

> but could use more.

If its 2743 and 2744 you would like to move along, then you must also be
interested  in GSS mechanisms other then Kerberos and how they could be
written to use these 
RFCs. The Globus GSI  which implements a GSS using PKI and SSL is one
example.
See: http://www.globus.org 

As we pointed out at the last IETF, we wished that there where a few
additions to the RFCs, but did not find any problems with the current
RFCs themselves. 

As an interoperability example, the Globus applications (including ssh
and ftp) are written to work with either the GSI or the Kerberos
mechanisms. This choice can be made at link time. When using the ssh
client, SecureCRT, on Windows, the choice can be made at run time via a
DLL. (If the mechglue was working for UNIX, UNIX could make the choice
at run time too.) 

So I would say that these RFCs are in good shape, and could move
forward. 

> Recognizing that several Kerberos-based GSS implementations exist, I'd

> like to solicit any summaries which their keepers can provide 
> concerning the scope of testing undertaken, other implementations that

> have been tested against, and particularly the sets of GSS-selectable 
> features which were exercised in testing.  Please send any results you

> can offer either to the CAT-WG list at [email-masked],

> or to me as CAT-WG chair. Thanks for any support you can provide in 
> this effort.
> 
> --jl

--