Generic Security Service Application Program Interface (GSS-API) Internationalization and Domain-Based Service Names and Name Type
Extracted elements (16)
Because domain and hostname components use DNS names, internationalization support (ACE/IDNA encoding) must be provided in the GSS-API interfaces to handle non-ASCII domain names consistently.
Domain-based names were introduced to allow GSS-API clients to authorize servers discovered via insecure methods (e.g., DNS SRV records without DNSSEC) without needing to secure the discovery method itself or add an extra authorization protocol. A server either has valid credentials for the domain-based name or it does not.
LDAP clients may require additional configuration at deployment time to enable or disable domain-based naming, because existing clients using host-based naming for SRV-discovered servers would break interoperability if switched to domain-based naming when servers have not been updated.
GSS_Display_name_utf8() MUST NOT output ACE-encoded internationalized domain names; it must output UTF-8 strings via its name_string output argument.
Implementations of GSS_Display_name() MUST only output US-ASCII or ACE-encoded internationalized domain names in the hostname and domain name slots of domain-based names.
Support for non-ASCII internationalized domain names SHOULD be provided through a new GSS_Import_name_utf8() function that MUST accept internationalized domain names both as UTF-8 strings and as ACE-encoded strings.
When domain-based names cannot be negotiated and fallback to host-based names is required, initiators MUST also verify that the acceptor's host-based name is authorized to provide the given service for the intended domain.
When the input_name_type parameter is the GSS_C_NT_DOMAINBASED_SERVICE OID, GSS_Import_name() implementations and GSS-API mechanisms MUST accept ACE-encoded internationalized domain names in the hostname and domain name slots.
A domain-based name consists of three required elements: a service name, a domain name, and a hostname. The syntax is 'service@domain@hostname' expressed in ABNF, where domain and hostname are DNS-style names.
A new GSS-API name-type is created with the symbolic name GSS_C_NT_DOMAINBASED_SERVICE and OID {iso(1) org(3) dod(6) internet(1) security(5) nametypes(6) gss-domain-based(5)}.
GSS_Display_name_utf8() is a new function that operates like GSS_Display_name() but outputs UTF-8 strings (not ACE-encoded) for internationalized domain names in domain-based names.
GSS_Import_name_utf8() is a new function that operates like GSS_Import_name() but accepts internationalized domain names as UTF-8 strings or ACE-encoded strings, enabling non-ASCII domain support in GSS-API.
IANA recorded a new name-type OID in the 'SMI Security for Name System Designators Codes (nametypes)' registry: value 5, 'gss-domain-based-services', referencing RFC 5178.
The mere existence of a domain-based service name conveys meaningful information usable in authorization decisions; administrators of distributed authentication services should be aware of the significance of service names for which they create acceptor credentials.
Use of GSS-API domain-based names may not be negotiable by some GSS-API mechanisms, and some acceptors may not support domain-based names; in such cases, initiators must fall back to host-based names and additionally verify the acceptor's authorization for the domain.
The domain-based name string syntax is defined as: domain-based-name = service "@" domain "@" hostname, where hostname = domain = sub-domain 1*(".", sub-domain), and sub-domain = Let-dig [Ldh-str].