Cross-realm and U2U (#19,...)

# I've not been familier with cross-realm nor U2U, so pointing
# out mistakes are truely appreciated.

Based on this and previous (<20050225114411XP%[email protected]>)
mails, I would propose:

- change the KINK_TGT_REQ payload to carry the responder's principal
  name.
- change the KINK_TGT_REP payload to carry only the TGT.
- when the resonder is requested a TGT, it returns an initial TGT in
  the same realm with the reqested responder's principal in the
  KINK_TGT_REQ.


----------------------------------------------------------------
In this mail (from here), I discuss which TGT should be returned to
the GETTGT command and how it works

Let's say:
A, B, and C is a realm.
initiator@A is a KINK initiator principal.
responder@C is a KINK responder principal.
responder@C is a user (or PKINIT) principal.
There is a trust relationship between A and B, and also between B and C.

When initiator@A wants to authenticate itself to responder@C,
there seems to be 2 ways:
1) initiator@A transit to the realm C and do an U2U authentication
   at the KDC in C.  The responder's TGT used here is the initial TGT
   of realm C.
2) responder@C transit to the realm A and do an U2U authentication
   at the KDC in A.  The responder's TGT used here is the cross-realm
   TGT for realm A.

While I'm not confident that I completely understand the concept of
the "trust relationship" represented as a inter-realm key, I think 1)
is the right way.  Reasons are below.

- If the trust relationship is unidirectional, 2) allows a
  "reverse-direction" authentication.
- initiator@A doesn't know whether responder@C can transit to the
  realm A, while it knows whether it can transit to the realm C, or at
  least can try it.

So my conclusion is the responder should return its initial TGT.
When the cross-realm and U2U case, the initiator should transit
to the responder's realm and do an U2U authentication there.

-- 
KAMADA Ken'ichi <[email protected]>