Projects/VerifyAuthData - Revision history

TomYu at 04:31, 16 February 2010

2010-02-16T04:31:47Z

2010-02-05T18:52:14Z

‎Changes to Kerberos 5 mechanism

2009-11-12T09:40:36Z

‎Naming extension APIs

2009-10-20T15:55:44Z

2009-10-10T01:10:33Z

2009-10-07T22:02:54Z

note approval

2009-09-21T16:18:40Z

‎Approvals

2009-09-21T16:18:21Z

‎Status

2009-09-15T17:24:42Z

2009-09-01T16:00:25Z

‎Architecture

@@ Line 74: / Line 74: @@
 ====Changes to Kerberos 5 mechanism====
-All of the naming extension APIs, save for gss_display_name_ext(), have been implemented in the Kerberos 5 mechanism. Most of the code is to be found in [http://src.mit.edu/opengrok/xref/users/lhoward/authdata/src/lib/gssapi/krb5/naming_exts.c naming_exts.c].
+All of the naming extension APIs, save for gss_display_name_ext(), have been implemented in the Kerberos 5 mechanism. Most of the code is to be found in [http://src.mit.edu/opengrok/krb5/xref/users/lhoward/authdata/src/lib/gssapi/krb5/naming_exts.c naming_exts.c].
 Previously, a Kerberos 5 mechanism name was represented by the type krb5_principal. This is now a structure containing an authorization data context as well as the principal name:

← Older revision		Revision as of 09:40, 12 November 2009
Line 49:		Line 49:

	* the <i>output</i> argument of gss_map_name_to_any() is a pointer to gss_any_t (presumably this is a typo in the document)		* the <i>output</i> argument of gss_map_name_to_any() is a pointer to gss_any_t (presumably this is a typo in the document)
−	* the <i>authenticated</i>, <i>asserted</i> and <i>all_attrs</i> arguments to gss_inquire_name() are pointers to gss_buffer_set_t
		+	* the signature of gss_inquire_name() is:
		+
		+	<pre>
		+	OM_uint32 KRB5_CALLCONV gss_inquire_name
		+	(
		+	OM_uint32 , / minor_status */
		+	gss_name_t, /* name */
		+	int , / name_is_MN */
		+	gss_OID , / MN_mech */
		+	gss_buffer_set_t * /* attrs */
		+	);
		+	</pre>
		+
		+	That is, there is a single output parameter enumerating attributes (rather than authenticated, asserted, and all_attrs), and it is a gss_buffer_set_t.

	====Changes to mechanism glue====		====Changes to mechanism glue====

@@ Line 643: / Line 643: @@
 Source name:	host/test.de.padl.com@DE.PADL.COM
-Attribute mspac: Authenticated Complete
+Attribute urn:mspac: Authenticated Complete
 050000000000000001000000b001000058000000000000000a00000034000000
 ...
-Attribute mspac:logon-info Authenticated Complete
+Attribute urn:logon-info Authenticated Complete
 01100800cccccccca001000000000000000002006ed28d68cd25ca01ffffffff
 ...
-Attribute mspac:client-info Authenticated Complete
+Attribute urn:mspac:client-info Authenticated Complete
 d64026ca012a0068006f00730074002f00720061006e0064002e006400
 ...
-Attribute mspac:upn-dns-info Authenticated Complete
+Attribute urn:mspac:upn-dns-info Authenticated Complete
 a00100016004000000000000000000068006f00730074002f00720061006e00
 ...
-Attribute mspac:server-checksum Authenticated Complete
+Attribute urn:mspac:server-checksum Authenticated Complete
 100000004b12be9500319e6fb731cb07
-Attribute mspac:privsvr-checksum Authenticated Complete
+Attribute urn:mspac:privsvr-checksum Authenticated Complete
 ffffff812d7a725e999ca41dd6e51fdc64d501

← Older revision		Revision as of 22:02, 7 October 2009
Line 1:		Line 1:
−	{{project-~~review\|2009-09-18~~}}	+	{{project-approved}}
−
−	<includeonly>[[Category: early stage projects]]</includeonly>

	==Background==		==Background==

← Older revision		Revision as of 16:18, 21 September 2009
Line 731:		Line 731:

	===Approvals===		===Approvals===
		+	[[User:Sbuckley\|Steve]] 16:18, 21 September 2009 (UTC)

	===Discussion===		===Discussion===

← Older revision		Revision as of 16:18, 21 September 2009
Line 722:		Line 722:

	Code is in the users/lhoward/authdata branch.		Code is in the users/lhoward/authdata branch.
		+	==Review==
		+
		+	This section documents the review of the project according to [[Project policy]].
		+	It is divided into multiple sections. First, approvals should be listed. To list an approval type
		+	:<nowiki>#~~~~</nowiki>
		+	on its own line.
		+	The next section is for summarizing discussion, which should take place on krbdev@mit.edu. Provide links to the archive at http://mailman.mit.edu/pipermail/krbdev/ if appropriate. Blocking objections can be noted with <nowiki>{{project-block}}</nowiki>.
		+
		+	===Approvals===
		+
		+	===Discussion===

← Older revision		Revision as of 17:24, 15 September 2009
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2009-09-18}}

	<includeonly>[[Category: early stage projects]]</includeonly>		<includeonly>[[Category: early stage projects]]</includeonly>

← Older revision		Revision as of 16:00, 1 September 2009
Line 19:		Line 19:

	The authorization data context encapsulates a set of authorization data <i>systems</i>, each which provide support for one or more authorization data types. Each system is instantiated as a <i>module</i>, one for each authorization data type. This is modelled closely on the client-side preauthentication SPI. The set of systems is extensible at runtime through a plug-in interface.		The authorization data context encapsulates a set of authorization data <i>systems</i>, each which provide support for one or more authorization data types. Each system is instantiated as a <i>module</i>, one for each authorization data type. This is modelled closely on the client-side preauthentication SPI. The set of systems is extensible at runtime through a plug-in interface.
		+
		+	If an authorization data system fails to verify an element, then krb5_rd_req() will fail; however, unknown elements are still ignored (behaviour which is backwards compatible but not compliant with RFC 4120). We may want to revisit this.

	===Windows PAC===		===Windows PAC===