The IESG has approved the following documents: - 'GSS-API Internationalization and Domain-Based Service Names and Name Type ' <draft-ietf-kitten-gssapi-domain-based-names-06.txt> as a Proposed Standard - 'GSS-API Domain-Based Service Names Mapping for the Kerberos V GSS Mechanism ' <draft-ietf-kitten-krb5-gssapi-domain-based-names-05.txt> as a Proposed Standard These documents are products of the Kitten (GSS-API Next Generation) Working Group. The IESG contact persons are Sam Hartman and Tim Polk. A URL of this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-kitten-gssapi-domain-based-names-06.txt Technical Summary This documentset describes domainname-based service principal names and the corresponding name type for the Generic Security Service Application Programming Interface (GSS-API) and the GSS-API Kerberos 5 mechanism. Domain-based service names are similar to host-based service names, but using a domain name (not necessarily an Internet domain name) in addition to a hostname. The primary purpose of domain-based names is to provide a measure of protection to applications that utilize insecure service discovery protocols. This is achieved by providing a way to name clustered services after the "domain" which they service, thereby allowing their clients to authorize the service's servers based on authentication of their service names. Working Group Summary The Kitten Working Group has achieved consensus that this document should be published as a Proposed Standard. Two weeks of discussion of the document and how applications would need to be modified to make use if its specification were extended by an additional week in order to reach consensus on additional examples. Protocol Quality This document has been reviewed by Sam Hartman for the IESG. Note to RFC Editor Create a new section after section 5: x. IANA Considerations The IANA should record the following new name-type OID in the IANA's "SMI Security for Name System Designators Codes (nametypes)" registry: 5 gss-domain-based [RFCxxxx] Add to the end of section 6 (Security Considerations): Note that, as with all service names, the mere existence of a domain-based service name conveys meaningful information that may be used by initiators for making authorization decisions; therefore, administrators of distributed authentication services should be aware of the significance of the service names for which they create acceptor credentials." _______________________________________________ IETF-Announce@ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce
