[2425] in Kerberos
Re: krb_get_phost
daemon@ATHENA.MIT.EDU (Theodore Ts'o)
Fri Dec 4 00:21:03 1992
Date: Fri, 4 Dec 92 00:04:26 EST
From: tytso@ATHENA.MIT.EDU (Theodore Ts'o)
To: Marc Horowitz <marc@MIT.EDU>
Cc: pato@APOLLO.HP.COM, Marc Horowitz <marc@MIT.EDU>, kerberos@MIT.EDU,
In-Reply-To: Marc Horowitz's message of Thu, 03 Dec 92 12:26:15 EST,
Date: Thu, 03 Dec 92 12:26:15 EST
From: Marc Horowitz <marc@MIT.EDU>
>> If we are about to establish a naming convention for vanilla V5 host
>> names, I would appreciate considering adopting the convention that
>> already exists in the DCE. Also note that Marc's proposal will simply
>> not work in a DCE environment since "hosts/<machine_name>" is already
>> a directory and can't be a principal node until DCE 1.1.
Well, my proposal used host/<machine_name>, not hosts/...., so it
would work, but it would also be gratuitously incompatible. IMHO, any
unneccesary divergence between MIT and DCE krb5 conventions is a bad
thing. So, I'll code up krb5_princ_name_from_host() to emulate the
DCE and send the patches into the krb5 bugs list.
Just so that everyone on the Kerberos list is caught up with things
(some of this conversation has dropped to private email).
First of all, Kerberos V5 does indeed have a convention: that is,
<service_name>/<machine_name>, where the machine name is the fully
qualified domain name (FQDN) of the host, in lowercase. A further
convention is if you are authenticating to host-level services (rlogin,
telnet, etc.) the service name is "host".
This convention has been around for a long time, and indeed has been
written up in the IETF's Kerberos V5 authenticated telnet spec. The
divergence between this convention and the DCE is unfortunate, but
that's the way it goes.
MIT's implementation does in fact have a standard routine already for
taking a service and hostname, and constructing the appropriate service
principal:
krb5_sname_to_principal(const char *,hostname,
const char *,sname,
krb5_boolean,canonicalize,
krb5_principal *,ret_princ)
The fact that some applications are not using this abstraction, and are
possibly not following the above convention, is a bug.
- Ted
