Re: IP address?

["Markus Moeller" <huaraz@moeller.plus.com>]

Thank you for the clarification.

Markus

----- Original Message ----- 
From: "Michael B Allen" <miallen@ioplex.com>
To: "Jeffrey Hutzelman" <jhutz@cmu.edu>
Cc: <heimdal-discuss@sics.se>; "Markus Moeller" <huaraz@moeller.plus.com>; 
"Paul Lathrop" <plathrop@digg.com>
Sent: Sunday, April 13, 2008 12:46 AM
Subject: Re: IP address?


> On Sat, 12 Apr 2008 19:34:33 -0400
> Jeffrey Hutzelman <jhutz@cmu.edu> wrote:
>
>> --On Saturday, April 12, 2008 12:53:56 PM +0100 Markus Moeller
>> <huaraz@moeller.plus.com> wrote:
>>
>> > Michael,
>> >
>> > I don't think your statement:
>> >
>> > That's ingrained into the protocol.
>> >
>> > is correct. AFAIK it is nowhere in the Kerberos (nor ssh) protocol
>> > defined that you have to use DNS names for the principals.
>>
>> RFC4462 section 7.1 specifies the use of GSS-API host-based service names
>> for SSH.  If you read the language in that section and in RFC2743 section
>> 4.1, it is fairly clear that the use of fully-qualified domain names is
>> intended.
>>
>> Kerberos itself certainly does not require the use of principal names of
>> any particular form, but applications using Kerberos, GSS-API, and/or 
>> SASL
>> generally do, because agreement on the correct principal name form is
>> required for interoperability.
>
> For the sake of completeness I'll just add that Windows also uses
> principals with NetBIOS names.
>
> Mike
>
> -- 
> Michael B Allen
> PHP Active Directory SPNEGO SSO
> http://www.ioplex.com/
>