[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: IP address?
On Sat, 12 Apr 2008 19:34:33 -0400
Jeffrey Hutzelman <firstname.lastname@example.org> wrote:
> --On Saturday, April 12, 2008 12:53:56 PM +0100 Markus Moeller
> <email@example.com> wrote:
> > Michael,
> > I don't think your statement:
> > That's ingrained into the protocol.
> > is correct. AFAIK it is nowhere in the Kerberos (nor ssh) protocol
> > defined that you have to use DNS names for the principals.
> RFC4462 section 7.1 specifies the use of GSS-API host-based service names
> for SSH. If you read the language in that section and in RFC2743 section
> 4.1, it is fairly clear that the use of fully-qualified domain names is
> Kerberos itself certainly does not require the use of principal names of
> any particular form, but applications using Kerberos, GSS-API, and/or SASL
> generally do, because agreement on the correct principal name form is
> required for interoperability.
For the sake of completeness I'll just add that Windows also uses
principals with NetBIOS names.
Michael B Allen
PHP Active Directory SPNEGO SSO