Subject: Proposed section on source identity selection

From: Sam Hartman <[email-masked]>
Date: Sun, 23 Oct 2005 17:55:43 -0400 (EDT)

Hi.

I'm about to submit 03 of the gss-naming informational document.
Here's the section I have to replace the existing section 7.  As you
may recall, the WG agreed that section was unclear.

I hope this provides enough context for a problem statement.  Comments
are of course welcome.

    <section title="Selection of Source Identity">
      <t>Today, applications such as e-mail clients and web browsers
      require connections  to multiple targets.  For each target the
      there may be one or more source identities that is appropriate
      for the connection.  Currently each application must choose the
      source name to use when acquiring credentials or  initiating a
      security context.  However the rules that applications use can
      be generalized to a large extent.  GSS-API could simplify
      application design and implementation by taking a larger role in
      selection of source identity to use when connecting to a
      particular target.</t>
      <t>Currently GSS-API credentials represent a single mechanism
      name.  that is, by the time credentials are acquired, a
      particular single identity must be chosen for each mechanism in
      the credential.  All these identities must correspond to a
      single mechanism independent name.  </t>
      <t>Two possibilities have been proposed for  involving GSS-API
      in the selection of source identities.  First, the restriction
      that a mechanism name  must be chosen when credentials are
      acquired could be relaxed.  Some name form would need to be
      used, but this name form could represent a set of
      possibilities.  The particular identity would be chosen when
      context establishment happened.  This could involve information
      received from the target in identity selection.</t>
      <t>Another possibility is to provide a mechanism to acquire
      credentials and to provide information about the target  when
      credentials are acquired.  This would be much less of a change
      to GSS-API but would not allow information received from the
      target to choose identity selection.</t>
      <t>With both approaches, information to communicate the needs of
      the application to the GSS-API mechanism will be required.  For
      example, hinting about whether information can be cached and
      about the scope of cache entries is required.  </t>

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Jeffrey Altman <[email-masked]>
Date: Sun, 23 Oct 2005 22:11:16 -0400

Sam:

Speaking as a participant of this group, I believe that this text is
an appropriate description of the problem the working group should
find solutions for.

Jeffrey Altman