[5198] in Kerberos
Re: V5: Can principal names have '@' in them?
daemon@ATHENA.MIT.EDU (Booker C. Bense)
Thu May 18 19:20:43 1995
To: kerberos@MIT.EDU
Date: 18 May 1995 10:53:30 -0700
From: bbense@shred.stanford.edu (Booker C. Bense)
In article <199505172035.AA09190@cayman-islands.isi.edu>,
Clifford Neuman <bcn@ISI.EDU> wrote:
> Date: 17 May 1995 20:06:33 GMT
> From: jik@cam.ov.com (Jonathan I. Kamens)
>
> With the V5beta2 release, running the command "kinit
> foobar@baz@GZA.COM" would yield the message "Password for
> foo@GZA.COM:", and obvious indicator of a bug of some sort in the
> principal parsing routine when it encounters two '@'s in a principal.
>
> V5beta4pl3, on the other hand, prints "kinit: Malformed representation of
> principal when parsing name foobar@baz@GZA.COM". Now, that's *better*, but
> I'm still not convinced it's correct, because I can't find anything in RFC
> 1510 that explicitly says that '@' is an illegal character in a
> principal name component.
- This is probably a minor point, but if you use the escape char your initial
request will work (i.e.
kinit 'foobar\@baz'@GZA.COM
(need the quotes to avoid shell escape. ) In fact you can use anything in the
principle name if you quote it correctly.
Dr. John O'Leary.med.sci.com
-can be entered as a valid kerberos principle.
>
> If it isn't, then "foobar@baz@GZA.COM" should parse into the principal
> "foobar@baz" in the realm "GZA.COM".
>
>You are correct. This should be parsed as the user foobar@baz in the
>realm GZA.COM.
>
> Does the current working draft of what will replace RFC 1510 say anything
> about this? Does anybody have any thoughts about whether '@' should be
> an illegal character in principal name components?
>
>I'll make sure that this makes it in. @ should not be illegal in
>principal name components. It probably should be illegal in DNS style
>realm name, though not illegal for other kinds of realm names. How to
>parse in an ambigious situation needs to be thought through.
- Doesn't the current escape character method solve this ? (i.e. if
the user wants to use "meta-chars" he need to resolve the ambigiuty
by explict quoting. Why can't the above parse into
foobar in the realm baz@GZA.COM ?
- Booker C. Bense : bbense@networking.stanford.edu
