Subject: Re: user != username != authentication-id, and what's a realm

From: Alexander Taler <[email-masked]>
Date: Tue, 04 May 1999 15:44:20 -0400

Hi, questions on the definitions of principal, auth-id, etc.

Alex

Paul B. Hill wrote:
> Principal - 1) A completely generic term used by the security community to
> include both people and computer systems. Coined because it is more
> dignified than "thingy" and because "object" and "entity" (which also mean
> thingy) were already overused. [1] 2) A uniquely named client or server
> instance that participates in a network communication. [2] 3) An entity
> which can both prove its identity and verify the identities of other
> principals who wish to communicate with it; each user and each service
> registered with Kerberos is thus a principal. [3]

If I stick a principal with a needle, will it bleed (or give me a shock)?
If so, then a user must be a principal.
 
> authentication-id - The "authentication identifier" used to uniquely
> identify the individual connecting to a service. The syntax and semantics
> of an authentication-id may be specific to a particular authentication
> mechanism, network, and/or host operating system. 

Later comments indicate that an auth-id is globally-unique so it must
contain a mechanism and a realm.  This explains why a username is not
an auth-id, because it does not include a mechanism and a realm.

> Coined by people that
> couldn't remember what principal means. [4]

Does this imply that principal and auth-id are the same?  Or is it
just here to add confusion :)

> Some further discussion of the above terms:
> 
> Principals, authentication-ids, and usernames are in general simple strings

Wait a second, it says above that a principal can prove its identity,
but a string can't do that.  Should this be "Authentication-Ids and
usernames are in general simple strings . . ."?

> Everyone is pretty familiar with the concept of a username, but usernames
> are not globally unique. The previous definitions of principal and
> authentication-id include uniqueness in the definition.

Does this mean that they include _global_ uniqueness in the
definition?

> 
> What do we mean by uniqueness?
> 
> That depends. Uniqueness comes at a price when you try to scale systems to
> large numbers. If you try to scale a principal name or authentication-id to
> be unique across the entire Internet most names with be difficult to
> memorize or type. X.500 addresses the uniqueness with distinguished names,

What's a "principal name"?  Is my principal name "Alexander Taler"?

An authentication id is distiguished from a username in that it is
globally unique, so this should probably read: "If you try to scale a
username to be unique across the entire Internet (i.e. make it an
authentication Id) . . ."