Subject: RE: Proposed draft on name referrals in Kerberos

From: "Mike Swift (NT)" <[email-masked]>
Date: Tue, 27 Jan 1998 09:55:20 -0800

The problem is that there is not a mapping between the domain portion of the
email name and the Kerberos realm. As a result, it is not possible for a
client machine to discover the correct realm for a particular name. In
addition, as this mechanism is used for obtaining the initial ticket, the
name mapping from a meta-directory cannot be trusted. By integrating the
mapping with the Kerberos protocol the client can trust the KDC to perform
the mapping properly.

- Mike

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, January 27, 1998 8:58 AM
To: Mike Swift (NT)
Cc: [email-masked]
Subject: Re: Proposed draft on name referrals in Kerberos

Couldn't this more easily be solved with some `mail address' to
principal conversion database? For hosts such a database is already in
widespread use.

/Johan

---

From: [email-masked] (Johan Danielsson)
Date: 27 Jan 1998 21:28:01 +0100

"Mike Swift (NT)" <[email-masked]> writes:

> The problem is that there is not a mapping between the domain
> portion of the email name and the Kerberos realm.

Not an obvious, no. That's what you need a database for.

> In addition, as this mechanism is used for obtaining the initial
> ticket, the name mapping from a meta-directory cannot be trusted.

No, but you don't have to. You can at most accomplish denial of
service.

> By integrating the mapping with the Kerberos protocol the client can
> trust the KDC to perform the mapping properly.

How can you know that it ism't a fake KDC you are talking to?

/Johan