Subject: Standardize Kerberos authentication and authorization in HTTP?

From: "Mike Spreitzer" <[email-masked]>
Date: Tue, 2 Nov 1999 13:52:09 PST

It seems to me that it would be good to have an IETF standard on how to do
Kerberos-based authentication and authorization in HTTP.  By the
authorization part I mean the ability to pass proxy tickets, including
forwarded and/or forwardable TGTs.  RFC 2712 (Kerberos in TLS) clearly
addresses the authentication part, but, because TLS doesn't address
authorization, does not clearly address the authorization part.  However, a
possible approach would be to use RFC 1964's technique of putting forwarded
tickets in the Authenticator (RFC 2712 *does* pass an Authenticator).  A
possible drawback of this approach is that some server-side products (e.g.,
Java Servelet engines) may not pass as many TLS details as they should.

Kerberos is well known in UNIX-land, and is coming in Windows 2000.  In
fact, Microsoft already has a way of doing both authentication and
authorization based on Kerberos.  An informed source tells me their
technique, while not publicly documented, is based on IETF standards (e.g.,
RFC 1964).  A plausible and happy scenario would be for them to submit
their technique, and a consensus formed around it.

Does this make sense to you?

Where should such an effort be homed?  Larry assures me the HTTP-WG is
shutting down and won't take any new work.  I don't have any strong opinion
on the matter.

Thanks,
Mike Spreitzer <[email-masked]>
http://parcweb.parc/spreitze/ (Xerox internal)
http://www.parc.xerox.com/spreitze/ (external)
+1-650-812-4833

---

From: "Kevin J. Dyer" <[email-masked]>
Date: Wed, 03 Nov 1999 11:34:59 -0500

>shutting down and won't take any new work.  I don't have any strong opinion

Shouldn't WWW Security be the sponsor of such an effort?  HTTP is the
basic protocol but it is up to the relevant WGs to recommend track
enhancements that will support the additional requirements (e.g.
WEBDAV).
===========================================================
Kevin J. Dyer                                Draper Laboratory  MS 35
Email: <[email-masked]>                    555 Tech. Sq.
Phone: 617-258-4962                          Cambridge, MA 02139
FAX: 617-258-2061
---------------------------------------------------------------------------- 
------------------------------------------
     _/_/_/_/     _/         _/  _/  _/       _/   _/_/_/_/
    _/      _/   _/_/     _/_/  _/  _/_/     _/  _/
   _/       _/  _/ _/   _/ _/  _/  _/  _/   _/   _/_/_/
 _/      _/   _/  _/ _/  _/  _/  _/    _/ _/         _/
_/_/_/_/     _/    _/   _/  _/  _/       _/  _/_/_/_/
        Data Management & Information Navigation Systems
===========================================================