Subject: PKINIT and the AD_INITIAL_VERIFIED_CAS and level of assurance

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 24 Jul 2007 09:14:21 -0500

After the krb-wg meeting we where discussing what information PKINIT
places in auth-data that would be available to a server so the server
could do its own "level of assurance". Nico pointed out that PKINIT
will add the AD_INITIAL_CERTIFIED_CAS to tickets, and this must
be copied to service tickets.

It appears to have ExternalPrincipalIdentifiers for all the CAs,
but it does not contain an ExternalPrincipalIdentifier for the user
certificate.

Thus the service can determine what CAs where used, but not
what user certificate was used to map to the kerberos principal.

This appears to be a missing piece of information which would
be very useful to the server, and might be all that is needed.

If the ExternalPrincipalIdentifier for the user certificate
was included as a separate auth-data like the AD_INITIAL_CERTIFIED_CAS
this this might go a long way in allowing the server to determine its
own level of assurance.

-- 

  Douglas E. Engert  <[email-masked]>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444