Re: Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06

On Mon, 2012-11-05 at 19:37 -0500, Tom Yu wrote:
> For discussion tomorrow:
> 
> While I was going through my database of Kerberos number assignments
> in preparation for handing off numbers to IANA, I found that there is
> a conflict for error code 82.  draft-ietf-krb-wg-pkinit-alg-agility-06
> has KDC_ERR_NO_ACCEPTABLE_KDF=82, while the published RFC 6111 has
> KRB_AP_ERR_PRINCIPAL_UNKNOWN=82.
> 
> I'm not sure how this happened.  I tried to find e-mail relevant to
> this assignment but could not.  (I haven't done a really extensive
> search though.)  Unfortunately, I also see
> 
> error_code KRB5KDC_ERR_NO_ACCEPTABLE_KDF, "No acceptable KDF offered"
> 
> in the MIT krb5 code, which we seem to have some released code
> referencing.  RFC 6111 seems to have priority, though:
> 
> 2007-03-03 draft-ietf-krb-wg-naming-03
> vs
> 2007-07-09 draft-ietf-krb-wg-pkinit-alg-agility-03
> 
> were the earliest versions of each that I could find.
> 
> What should we do about this?  Has anyone implemented anything that
> uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?
> 
> Sam has suggested that we overload the error code, because there
> shouldn't be a situation where an unknown well-known principal name is
> used in conjunction with PKINIT algorithm agility.  I think it's still
> possible, but unlikely.

If it is the error I thin it is I think we use that error code in
FreeIPA to detect when some users need migration.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg