https://k5wiki.test.kerberos.org/wiki?action=history&feed=atom&title=Projects%2FSignedPathNamingExts 2026-05-14T18:11:26Z Revision history for this page on the wiki MediaWiki 1.27.4 https://k5wiki.test.kerberos.org/wiki?title=Projects/SignedPathNamingExts&diff=3275&oldid=prev 2010-05-09T10:57:46Z

<p>‎<span dir="auto"><span class="autocomment">Status</span></span></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 10:57, 9 May 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 21:</td> <td colspan="2" class="diff-lineno">Line 21:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Status==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Status==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/<del class="diffchange diffchange-inline">iakerb</del> users/lhoward/signedpath-naming-exts branch].</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/<ins class="diffchange diffchange-inline">signedpath-naming-exts</ins> users/lhoward/signedpath-naming-exts branch].</div></td> </tr> </table>

Lukeh https://k5wiki.test.kerberos.org/wiki?title=Projects/SignedPathNamingExts&diff=3274&oldid=prev 2010-05-08T17:27:46Z

<p></p> <table class="diff diff-contentalign-left" data-mw="interface"> <col class='diff-marker' /> <col class='diff-content' /> <col class='diff-marker' /> <col class='diff-content' /> <tr style='vertical-align: top;' lang='en'> <td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td> <td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 17:27, 8 May 2010</td> </tr><tr> <td colspan="2" class="diff-lineno">Line 3:</td> <td colspan="2" class="diff-lineno">Line 3:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Background==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Background==</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">−</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Implement a mechanism for exposing the constrained delegation<del class="diffchange diffchange-inline"> transited services</del> path via GSS naming extensions.</div></td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Implement a mechanism for exposing the constrained delegation path via GSS naming extensions.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Architecture==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Architecture==</div></td> </tr> <tr> <td colspan="2" class="diff-lineno">Line 12:</td> <td colspan="2" class="diff-lineno">Line 12:</td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>No support for the transited services encoding in [MS-PAC] is yet provided, because that would require an NDR interpreter within the krb5 runtime. This would be more suitably implemented as a third-party plugin.</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>No support for the transited services encoding in [MS-PAC] is yet provided, because that would require an NDR interpreter within the krb5 runtime. This would be more suitably implemented as a third-party plugin.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>==Open issues==</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>It's impossible to mark this attribute as authenticated because the delegation path is signed with the TGS key, which the GSS acceptor does not have. A KDC that supports KRB5_AUTHDATA_SIGNTICKET will reject such user-submitted authorization data, but the acceptor has no in-band knowledge of what kind of KDC issued the ticket.</div></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td colspan="2" class="diff-empty">&#160;</td> <td class="diff-marker">+</td> <td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Interestingly this would not be an issue with the [MS-PAC] delegation path, because it is also signed with the acceptor key.</div></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"></td> </tr> <tr> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Status==</div></td> <td class="diff-marker">&#160;</td> <td style="background-color: #f9f9f9; color: #333333; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #e6e6e6; vertical-align: top; white-space: pre-wrap;"><div>==Status==</div></td> </tr> </table>

Lukeh https://k5wiki.test.kerberos.org/wiki?title=Projects/SignedPathNamingExts&diff=3273&oldid=prev 2010-05-08T17:21:24Z

<p>New page: {{project-rel|1.9}} ==Background== Implement a mechanism for exposing the constrained delegation transited services path via GSS naming extensions. ==Architecture== ==Implementation== ...</p> <p><b>New page</b></p><div>{{project-rel|1.9}}<br /> <br /> ==Background==<br /> <br /> Implement a mechanism for exposing the constrained delegation transited services path via GSS naming extensions.<br /> <br /> ==Architecture==<br /> <br /> ==Implementation==<br /> <br /> A new authorization data naming extensions backend is added in src/lib/krb5/krb/s4u_authdata.c. This maps the &quot;delegated&quot; member of krb5_ad_signedpath (KRB5_AUTHDATA_SIGNTICKET) to the urn:constrained-delegation:transited-services attribute.<br /> <br /> No support for the transited services encoding in [MS-PAC] is yet provided, because that would require an NDR interpreter within the krb5 runtime. This would be more suitably implemented as a third-party plugin.<br /> <br /> ==Status==<br /> <br /> Code is in the [http://src.mit.edu/fisheye/browse/krb5/users/lhoward/iakerb users/lhoward/signedpath-naming-exts branch].</div>

Lukeh