Re: choosing principal names

On Wed, 5 Oct 2011, [email protected] wrote:

> This possibly should go instead to some hypothetical wiki page?
>
> I believe it is better to write here than to let it remain unsaid.
>
> Things to have in mind while choosing principal names.
> -----------------------------------------------------
>

You are putting more meaning in principal names than actually
exists. The / is just one of many available characters as far
as kerberos is concerned. A principal is simply a string of
allowable characters, nothing more , nothing less.

//////@FOO.REALM

makes as much sense to kerberos as anything. The only thing
"kerberos" cares about is that the client and server have some
a priori rules for constructing the principal name outside of
the protocol. The notion of principal and instance is a broken
idea from kerberos IV that has been removed from krb5.

It is up to the authorization system your application implements
to interpret those strings. Since there is no standard 
authorization service, there can be no standard principal naming
scheme.

Your post just hides the real issue is that kerberos programmers 
need to be aware that kerberos only provides 2 legs of the 
security triple, Data Integrity and Authentication. It is 
complete crap at authorization. If you are doing anything but 
handing off the principal string to your authorization system, 
your application is broken.

Now since most kerberos apps are ancient and evolved without a 
clear standard for authorization they all have crap ad hoc 
authorization schemes. Your post just simply propagates the same
bad broken design.

- Booker C. Bense