[5206] in Kerberos
Re: V5: Can principal names have '@' in them?
daemon@ATHENA.MIT.EDU (Dan Nessett)
Fri May 19 16:13:54 1995
Date: Fri, 19 May 1995 12:44:16 -0700
From: Danny.Nessett@Eng.Sun.COM (Dan Nessett)
To: bcn@ISI.EDU, tytso@MIT.EDU
Cc: jik@cam.ov.com, kerberos@MIT.EDU
Ted, Cliff, Jon and whomever is interested in my opinion (probably only me),
Its pretty easy to write a parser to separate username and realm if either :
1) the username isn't allowed to have '@' in it, but the realm is
[find first '@' and break at that point]
2) the realm isn't allowed to have '@' in it, but the username is
[find last '@' and break at that point]
I propose that allowing '@' to act as a delimiter and as an arbitrary character
in both of these fields results in an ambiguous grammer i.e., you can't write a
parser to figure out what is meant. So, I suggest the following rule :
The username can have '@' in it, but realm names cannot. There are
reasons why usernames should allow this (e.g,, Solaris netnames are of the
form : unix.<uid>@<nisplus-domain>. However, I would be suprised if any
existing realm name components have embedded '@' characters. Allowing such,
in my view, is an example of gratuitous flexibility [OK, them's fighting
words, so I have put on my flame proof suit in expectation of some internet
heat :-) ]
Dan
