[20056] in Kerberos_V5_Development
Re: Current semantics for channel-bindings in GSSAPI
daemon@ATHENA.MIT.EDU (Isaac Boukris)
Tue Mar 10 09:54:08 2020
MIME-Version: 1.0
In-Reply-To: <CAC-fF8T6y2FKHS9fO62kVKKuB22VTEdjLhDZA+=UnVWiaqM56g@mail.gmail.com>
From: Isaac Boukris <iboukris@gmail.com>
Date: Tue, 10 Mar 2020 14:53:18 +0100
Message-ID: <CAC-fF8SOMeOMXubqK-27jhS4fALu-jM4=nue466hHLwmHOGvYQ@mail.gmail.com>
To: Stefan Metzmacher <metze@samba.org>
Cc: "krbdev@mit.edu Dev List" <krbdev@mit.edu>, Simo Sorce <simo@redhat.com>,
Nico Williams <nico@cryptonector.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
As discussed last week, we want the following changes.
- MIT should match Heimdal behavior and only error if client bindings
are not all zeros.
- Both Heimdal/MIT should return channel-bound flag if the bindings did match.
- Both Heimdal/MIT should take advantage of KERB_AP_OPTIONS_CBT if
present if authenticator, in which case if the server passed bindings
they must match.
- Both Heimdal/MIT should provide a conf option to asset the client
system supports channel-bindings, causing KERB_AP_OPTIONS_CBT to be
sent in any ap-req.
I submitted wip PR #1047 upstream MIT based on the above.
@metze, would that satisfy samba's requirements?
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
