Re: documentation vs specification

On 10/3/2011 9:29 AM, <[email protected]> wrote:
> It is plain unwise that part of the protocols remain undefined
> (and are being reverse-engineered) even today. This is not a matter of
> documentation, this is a matter of a missing specification.

Credential cache and keytab file formats are not protocols.  They are
implementation specific data formats in exactly the same fashion as the
krb5 api is an implementation specific api.  These are outside the
bounds of what the IETF standardizes.

MIT developed an implementation of the Kerberos protocol and has
modified it over the years as the IETF has refined the protocol
standards and customers (end users, operating system vendors, and now
Kerberos Consortium members) push them in various directions.  MIT did
not document their internal data structures or proprietary file formats
because those objects were meant for their own use.  Operating system
vendors that forked MIT's source code have often made modifications of
their own.

> I hope there are people here familiar with standardization processes
> who would suggest a way to fix this awkward situation.

The problem is that there is no standardization process for
implementation specific data stores.  The credential cache file format
of MIT's is really no different then their KDC database format.  Its a
proprietary internal that uses an api with behaviors that are their own.

> The original question "how to handle ccache reliably" can not be
> answered at all, unless we either 1. have an implementation-independent
> definition of ccache format and semantics or 2. assume that all
> applications sharing kerberos-related data use One True Implementation.

It is true that it cannot be answered with file caches.  However, there
are other credential cache implementations.  Personally, I believe that
credential caches and key tables should have platform specific
implementations which the Kerberos implementations simply call into.
This is in fact how credentials caches are being used in the Heimdal
port for Windows.  Credential cache implementations are plug-ins.
Choose one of the existing implementations or write one that meets your
needs.  Then plug it in.

You can't solve the problems of this thread using file caches.  Use KCM
or Keyrings or something else that actually has the semantics that are
required.

> The second assumptions is not true, and it is actually Heimdal who first
> broke it. I guess even MIT people would now be inclined to follow the
> reality and agree on a properly written keytab/ccache interoperability
> standard? (a format _and_ semantics/behavior at concurrent access).

There is not one MIT FILE ccache format.  The format has changed
numerous times over the years.  Heimdal did not break anything.

Jeffrey Altman

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iQEcBAEBAgAGBQJOicKlAAoJENxm1CNJffh4L7YIAOUZ/hUWaZZY7q9iQpd1rDsW
2ovlAcmIqFywg5WWGfU4FgALgbluNtprfD6XfSifW5ve8r1l4t6pZvCID1d60ddc
y0ZDUsd+1SBO0STji5ixDJCtjEGvena/KWMtmoFNC1tG/M1s6AAPfr1x3YcF0a2B
3Q4UHFv+A4QRgk6ZkQpOzTvXyBCzKT+7TIXdPYf07dIIFVnvEGE7IvDyw0WzTCWP
ADt5cnaXJFVY7IY58oaVlJdp9fRfG+oKeIwV9JaUqckgknQKd6CDZm55j7LVr7Yt
rPIWviiU89wA3XHYIZivvehO6CTLjwdjGc1OH0PwSZfGN51LGZmkfwjXQ/eGWKo=
=qgVk
-----END PGP SIGNATURE-----