Subject: [kitten] [Leif Johansson] Re: [abfab] EAP naming attribute document

From: Sam Hartman <[email-masked]>
Date: Thu, 18 Aug 2011 13:39:31 -0400

Consider it an early IETF last call comment that multiple people think
we should add a security considerations note about multiple attribute
values from different issuers.
I bet Nico supports this as well based on conversations we've had.

Subject: Re: [abfab] EAP naming attribute document
From: Leif Johansson <[email-masked]>
To: [email-masked]
Date: Thu, 18 Aug 2011 15:18:43 +0200
List-Id: "Application Bridging, Federated Authentication Beyond \(the web\)" <abfab.ietf.org>

On 08/18/2011 03:02 PM, Luke Howard wrote:
> Right you are.
> 
> On 18/08/2011, at 12:49 PM, Sam Hartman wrote:
> 
>>>>>>> "Luke" == Luke Howard <[email-masked]> writes:
>>
>>>>> GSS naming extensions does not really support this; I'd say the
>>>>> behavior should be undefined until GSS has a story for this.
>>>>
>>>> So I would expect that current GSS behavior would be to say
>>>> randomly return one of them rather than fail.  An issue to
>>>> potentially raise on kitten.
>>
>>    Luke> GSS naming extensions does support multiple valued attributes.
>>
>> I don't think it's reasonable to use that support if different values
>> come from different issuers.

+1 that actually sounds like something that should go into a security
considerations text somewhere.

	Cheers Leif
_______________________________________________
abfab mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/abfab