Subject: [Ietf-krb-wg] Fw: [SPAM] Re: I-D Action:draft-sorce-krbwg-general-pac-00.txt

From: Simo Sorce <[email-masked]>
Date: Fri, 8 Oct 2010 14:42:37 -0400

Sorry forgot to CC the WG list.

Begin forwarded message:

Date: Fri, 8 Oct 2010 14:41:41 -0400
From: Simo Sorce <[email-masked]>
To: "Scott Cantor" <[email-masked]>
Subject: Re: [Ietf-krb-wg] [SPAM] Re: I-D
Action:draft-sorce-krbwg-general-pac-00.txt

On Fri, 8 Oct 2010 13:48:10 -0400
"Scott Cantor" <[email-masked]> wrote:

> I saw from reading the draft and the other thread that you're talking
> about POSIX data. That's extraordinarily limiting to me,

That's why if you read carefully you will see that there is room for
additional data blobs. Extensions to add more data are possible and
accounted for, I am just concentrating on the bare minimum for this to
be useful.

> but moreover
> I don't understand how you could safely map UID or GID information
> across domains. You seem to start with the premise that federation is
> involved (else I'd just use LDAP and be done with it) but then defeat
> any hope of using it safely by passing data that has no possible
> meaning across disparate systems.

That depends on the configuration of the domains.
If you built them with advance knowledge that you'll want to share data
between the 2 domains all you need to do is to make sure the ID ranges
used by the 2 domains do not overlap. In that case IDs can be reused in
one or the other domain without any problem (the KDC will have the
range in a configuration attribute so that it can enforce they are
respected trimming out anything outside of the acceptable range).

If ID spaces overlap, a simple method is bulk relocation, adding the
same base number to all Ids of the foreign domain. Again the KDC can do
this operation and the trusting KDC can enforce that the trusted KDC is
not trying to sneaking in conflicting IDs by operating filtering on
allowed ranges.

More complex mappings are possible of course.
Also, KDCs may have to be exposed to some communication between
realms/domains, but that does not imply all clients/services have to.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

-- 
Simo Sorce * Red Hat, Inc * New York
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Scott Cantor" <[email-masked]>
Date: Fri, 8 Oct 2010 15:02:07 -0400

> respected trimming out anything outside of the acceptable range).

I guess I would imagine that that degree of coupling is more amenable to
much simpler means of exchange of this kind of user information, but YMMV.

All the options you talked about seem like a lot of implicit behavior that
would need to get standardized to make a particular datum work that really
doesn't seem too well suited to the overall problem of identifying users in
a globally safe fashion.
 
-- Scott