[2490] in Kerberos
V5: Inter-Realm-Authentication
daemon@ATHENA.MIT.EDU (Clifford Neuman)
Sat Jan 2 20:09:01 1993
Date: Sat, 2 Jan 93 14:47:35 PST
From: Clifford Neuman <bcn@ISI.EDU>
To: Christian.Kuehnke@arbi.informatik.uni-oldenburg.de
Cc: kerberos@MIT.EDU
In-Reply-To: Christian Kuehnke's message of Fri, 1 Jan 1993 23:20:22 GMT <1993Jan1.232124.28836@arbi.Informatik.Uni-Oldenburg.DE>
Date: Fri, 1 Jan 1993 23:20:22 GMT
From: Christian.Kuehnke@arbi.informatik.uni-oldenburg.de (Christian Kuehnke)
I've got a question regarding inter-realm authentication in
Kerberos V5. I think the "Internet-Draft" leaves some gaps open in
this field.
Situation: Client c in Realm rc wants to communicate with
Server s in Realm rs.
Now, I see two possibilities:
a) c requests from his TGS a TGT for Realm rs
b) c requests from his TGS a Ticket for (s,rs)
Which one is the proper procedure? Assume that no interaction with
intermediate Realms is necessary. In both of these cases, the
response would be the same: A TGT for Realm rs, with which the
client could request a Ticket for s from the remote TGS. Right?
The proper procedure is (a). The inclusion of the servers realm in
the request was a recent addition to allow a single KDC to support
multiple realms (as you pointed out, that change did not make it into
the pseudo code). However, that change also opens up the possibility
of asking for a ticket for the end server directly from the local KDC
(as in b). I will define the correct behavior for handling such a
request. However, the answer to your question is that the correct
procedure for the client is still (a).
But what does a TGT for a "remote" Realm then look like? Of course,
the statement holds for Tickets for application servers. But for
the example given above, shouldn't be realm=rs, sname=s?
Especially, because in the pseudocode for KRB_TGS_REP generation
(A.6), the realm of the resulting ticket always is set to the realm
the TGT is for.
A TGT for a remote realm will be for the form krbtgt/remoterealm@LOCALREALM
where LOCALREAM is the name of the realm issuing the ticket granting ticket.
This is described in section 8.2.3 of the spec (dated 1 September 1992).
~ Cliff
