[179] in WWW Security List Archive
Re: OBCSCR
daemon@ATHENA.MIT.EDU (Mary Ellen Zurko)
Mon Oct 3 21:34:15 1994
From: zurko@osf.org (Mary Ellen Zurko)
To: www-security@ns1.rutgers.edu, www-buyinfo@allegra.att.com
Date: Mon, 3 Oct 94 14:55:50 EDT
Cc: zurko@osf.org (Me)
Reply-To: zurko@osf.org (Mary Ellen Zurko)
Phill says:
> Because HTTP is simple it is easy to encapsulate other protocols.
Actually, we've found it incredibly easy to encapsulate HTTP in DCE
RPC. That way we get ACL-based authorization, Kerberos-based
authentication, cell-based security registration and authorities,
location-independant name, and transport independance, all today (OK,
we haven't written the ACL Mgr quite yet...). We're an Out-Of-Band
solution, though not Challenge/Response based.
Does anyone have technical arguments around the difference between getting encapsulated or being encapsulated?
Mez
