Re: choosing principal names

On Wed, Oct 05, 2011 at 08:41:25AM -0700, Booker Bense wrote:
> It is up to the authorization system your application implements
> to interpret those strings. Since there is no standard 
> authorization service, there can be no standard principal naming
> scheme.

Exactly. There can not be "a standard authorization service" as
authorization is fundamentally service-specific.

> Your post just hides the real issue is that kerberos programmers 
> need to be aware that kerberos only provides 2 legs of the 
> security triple, Data Integrity and Authentication.

You address here, totally correctly, one of the common misunderstandings.

I address mostly a bunch of other ones. I name also that Kerberos does
not participate in authorization.

It would be a mistake to forget that it is the very principal name which
is being analyzed (e.g. matched) for authorization.

(That's why authentication is necessary in the first hand, to confirm
that "this string really is the other party's identity".)

> Now since most kerberos apps are ancient and evolved without a 
> clear standard for authorization they all have crap ad hoc 
> authorization schemes.

> Your post just simply propagates the same bad broken design.

Hmm... My intention was quite the opposite :-)
Hope you will not interpret it so negatively after some more
consideration.

Thanks for comments!

Regards,
Rune