Re: Review of draft-ietf-krb-wg-referrals-13.txt

On 03/21/2012 10:44 AM, Tom Yu wrote:
> While I was rereading the document, I found the following error in
> Appendix A:
> 
>           PA-SVR-REFERRAL-DATA ::= SEQUENCE {
>                  referred-name   [1] PrincipalName OPTIONAL,
>                  referred-realm  [0] Realm
>           }}
> 
> should probably be:
> 
>           PA-SVR-REFERRAL-DATA ::= SEQUENCE {
>                  referred-realm  [0] Realm,
>                  referred-name   [1] PrincipalName OPTIONAL
>           }

I can confirm that the ASN.1 encoder we had in our tree matches the
element order of the corrected definition ([0] realm, [1] principal
name), although nothing in our tree actually uses the encoder.  But this
is evidence of what eDirectory did.

Heimdal uses:

	PA-ServerReferralData ::= SEQUENCE {
		referred-realm          [0] Realm OPTIONAL,
		true-principal-name     [1] PrincipalName OPTIONAL,
		requested-principal-name [2] PrincipalName OPTIONAL,
		referral-valid-until     [3] KerberosTime OPTIONAL,
		...
	}

which matches the corrected definition up until the additional elements
and extensibility marker.  However, Heimdal's code confuses me because
it appears to look for an element in the KDC-REP's pa-data sequence,
with the element's value encrypted in the session key.  The draft
description suggests that the code should be looking for a pa-data
element in the EncKDCRepPart's encrypted-pa-data sequence.
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg