Update gnulib files.

[shishi.git] / doc / specifications / draft-johansson-kerberos-model-01.txt

Network Working Group                                          Johansson
Internet-Draft                                      Stockholm university
Expires: December 30, 2004                                     July 2004



              An information model for Kerberos version 5
                     draft-johansson-kerberos-model-01


Status of this Memo


   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.


   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as
   Internet-Drafts.


   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."


   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.


   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.


   This Internet-Draft will expire on December 30, 2004.


Copyright Notice


   Copyright (C) The Internet Society (2004).  All Rights Reserved.


Abstract


   This document describes an information model for Kerberos version 5
   from the point of view of an administrative service.  There is no
   standard for administrating a kerberos 5 KDC.  This document
   describes the services exposed by an administrative interface to a
   KDC.











Johansson              Expires December 30, 2004                [Page 1]
Internet-Draft    An information model for Kerberos version 5  July 2004



Table of Contents


   1.  Requirements notation  . . . . . . . . . . . . . . . . . . . .  3
   2.  Motivation . . . . . . . . . . . . . . . . . . . . . . . . . .  4
   3.  How to interpret RFC2119 terms . . . . . . . . . . . . . . . .  5
   4.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . .  6
   5.  Information model  . . . . . . . . . . . . . . . . . . . . . .  7
     5.1   Principal  . . . . . . . . . . . . . . . . . . . . . . . .  7
       5.1.1   Principal: Attributes  . . . . . . . . . . . . . . . .  7
       5.1.2   Principal: Associations  . . . . . . . . . . . . . . .  7
       5.1.3   Principal: Remarks . . . . . . . . . . . . . . . . . .  8
     5.2   KeySet . . . . . . . . . . . . . . . . . . . . . . . . . .  8
       5.2.1   KeySet: Attributes . . . . . . . . . . . . . . . . . .  8
       5.2.2   KeySet: Associations . . . . . . . . . . . . . . . . .  8
       5.2.3   KeySet: Remarks  . . . . . . . . . . . . . . . . . . .  8
     5.3   Key  . . . . . . . . . . . . . . . . . . . . . . . . . . .  9
       5.3.1   Key: Attributes  . . . . . . . . . . . . . . . . . . .  9
       5.3.2   Key: Associations  . . . . . . . . . . . . . . . . . .  9
       5.3.3   Key: Remarks . . . . . . . . . . . . . . . . . . . . . 10
     5.4   Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 10
       5.4.1   Policy: Attributes . . . . . . . . . . . . . . . . . . 10
       5.4.2   Password Quality Policy  . . . . . . . . . . . . . . . 10
       5.4.3   Password Management Policy . . . . . . . . . . . . . . 10
       5.4.4   Keying Policy  . . . . . . . . . . . . . . . . . . . . 11
   6.  Implementation Scenarios . . . . . . . . . . . . . . . . . . . 12
     6.1   LDAP backend to KDC  . . . . . . . . . . . . . . . . . . . 12
     6.2   LDAP frontend to KDC . . . . . . . . . . . . . . . . . . . 12
     6.3   SOAP . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
   7.  Security Considerations  . . . . . . . . . . . . . . . . . . . 13
   8.  Remarks  . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
   9.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 14
       Author's Address . . . . . . . . . . . . . . . . . . . . . . . 14
       Intellectual Property and Copyright Statements . . . . . . . . 15



















Johansson              Expires December 30, 2004                [Page 2]
Internet-Draft    An information model for Kerberos version 5  July 2004



1.  Requirements notation


   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].















































Johansson              Expires December 30, 2004                [Page 3]
Internet-Draft    An information model for Kerberos version 5  July 2004



2.  Motivation


   The Kerberos version 5 authentication service described in [RFC1510]
   describes how a Key Distribution Service (KDC) provides
   authentication to clients.  The standard does not stipulate how a KDC
   is managed and several "kadmin" servers have evolved.  This document
   describes the services required to administrate a KDC and the
   underlying information model assumed by a kadmin-type service.


   The information model is written in terms of "attributes" and
   "services" or "interfaces" but the use of these particular words MUST
   NOT be taken to imply any particular modeling paradigm so that
   neither an object oriented model or an LDAP schema is intended.  The
   author has attempted to describe in natural language the intended
   semantics and syntax of the components of the model.  An LDAP schema
   (for instance) based on this model will be more precise in the
   expression of the syntax while preserving the semantics of this
   model.


   Implementations of this document MAY decide to change the names used
   (eg principalName).  If so an implementation MUST provide a name to
   name mapping to this document.






























Johansson              Expires December 30, 2004                [Page 4]
Internet-Draft    An information model for Kerberos version 5  July 2004



3.  How to interpret RFC2119 terms


   This document describes an information model for kerberos 5 but does
   not directly describe any mapping onto a particular schema- or
   modelling language.  Hence an implementation of this model consists
   of a mapping to such a language - eg an LDAP or SQL schema.  The
   precise interpretation of terms from [RFC2119] therefore require some
   extra explanation.  The terms MUST, MUST NOT, REQUIRED, SHALL, SHALL
   NOT mean that an implementation MUST provide a feature but does not
   mean that this feature MUST be REQUIRED by the implementation - eg an
   attribute is available in an LDAP schema but marked as OPTIONAL.  If
   a feature must be implemented and REQUIRED this is made explicit in
   this model.  The term MAY, OPTIONAL and RECOMMENDED means that an
   implementation MAY need to REQUIRE the feature due to the particular
   nature of the schema/modelling language.  In some cases this is
   expressly forbidden by this model (feature X MUST NOT be REQUIRED by
   an implementation).


   Note that any implementation of this model SHOULD be published as an
   RFC.
































Johansson              Expires December 30, 2004                [Page 5]
Internet-Draft    An information model for Kerberos version 5  July 2004



4.  Acknowledgments


   Love H÷rnquist-Êstrand <lha@it.su.se> for important contributions.

















































Johansson              Expires December 30, 2004                [Page 6]
Internet-Draft    An information model for Kerberos version 5  July 2004



5.  Information model


5.1  Principal


   The fundamental entity stored in a KDC is the principal.  The
   principal is associated to keys and generalizes the "user" concept.
   The principal MUST be implemented in full and MUST NOT be optional in
   an implementation


5.1.1  Principal: Attributes


5.1.1.1  principalName


   The principalName MUST uniquely identify the principal within the
   administrative context of the KDC.  The type of the principalName is
   not described in this document.  It is a unique identifier and can be
   viewed as an opaque which can be compared for equality.


5.1.1.2  principalNotUsedBefore


   The principal may not be used before this date.  The syntax of the
   attribute MUST be semantically equivalent with the standard ISO date
   format.


5.1.1.3  principalNotUsedAfter


   The principal may not be used after this date.  The syntax of the
   attribute MUST be semantically equivalent with the standard ISO date
   format.


5.1.1.4  principalIsDisabled


   A boolean attribute used to temporarily disable a principal.


5.1.1.5  principalAliases


   This multivalued attribute contains a set of aliases for the
   principal.


5.1.2  Principal: Associations


   Each principal MAY be associated with 1 or more KeySet and MAY be
   associated with 1 or more Policies.  The KeySet is represented as an
   object in this model since it has attributes associated with it (the
   key version number).  In typical situations the principal is
   associated with exactly 1 KeySet but implementations MUST NOT assume
   this case, i.e an implemenation of this standard (e.g an LDAP schema)
   MUST be able to handle the general case of multiple KeySet associated




Johansson              Expires December 30, 2004                [Page 7]
Internet-Draft    An information model for Kerberos version 5  July 2004



   with each principal.


5.1.3  Principal: Remarks


   Traditionally a principal consists of a local-part and a realm
   denoted in string form by local-part@REALM.  The realm concept is
   used to provide administrative boundaries and together with
   cross-realm authentication provides scalability to Kerberos 5.
   However the realm is not central to an administrative information
   model.  For instance the initialization or creation of a realm is
   equivalent to creating a specific set of principals (krbtgt@REALM,
   etc) which is covered by the model and services described in this
   document.  A realm is typically associated with policy covering (for
   instance) keying and password management.  The management of such
   policy and their association to realms is beyond the scope of this
   document.


5.2  KeySet


   A KeySet is a set of keys associated with exactly one principal.
   This object and its associations MUST NOT be REQUIRED by an
   implementation.  It is expected that most implementations of this
   standard will use the set/change password protocol for all aspects of
   key management [I-D.ietf-krb-wg-kerberos-set-passwd].  This
   information model only includes these objects for the sake of
   completenes.


5.2.1  KeySet: Attributes


5.2.1.1  keySetVersionNumber


   This is traditionally called the key version number (kvno).


5.2.2  KeySet: Associations


   To each KeySet MUST be associated a set of 1 or more Keys.


5.2.3  KeySet: Remarks


   The reason for separating the KeySet from the Principal is security.
   The security of Kerberos 5 depends absolutely on the security of the
   keys stored in the KDC.  The KeySet type is provided to make this
   clear and to make separation of keys from other parts of the model
   clear.


   Implementations of this standard (eg an LDAP schema) MUST preserve
   this distinction.





Johansson              Expires December 30, 2004                [Page 8]
Internet-Draft    An information model for Kerberos version 5  July 2004



5.3  Key


   Implementations of this model MUST NOT REQUIRE keys to be
   represented.


5.3.1  Key: Attributes


5.3.1.1  keyEncryptionType


   The enctype.  The precise representation depends on the
   implementation.


5.3.1.2  keyValue


   The binary representation of the key data.


5.3.1.3  keySaltValue


   The binary representation of the key salt.


5.3.1.4  keyStringToKeyParameter


   The syntax of this opaque object is defined by the encryption type
   used.


5.3.1.5  keyNotUsedAfter


   This key MUST NOT be used after this date.  The syntax of the
   attribute MUST be semantically equivalent with the standard ISO date
   format.


5.3.1.6  keyNotUsedBefore


   This key MUST NOT be used before this date.  The syntax of the
   attribute MUST be semantically equivalent with the standard ISO date
   format.


5.3.1.7  keyIsDisabled


   If this attribute is true the key MUST NOT be used.  This is used to
   temporarily disable a key.


5.3.2  Key: Associations


   None







Johansson              Expires December 30, 2004                [Page 9]
Internet-Draft    An information model for Kerberos version 5  July 2004



5.3.3  Key: Remarks


   The security of the keys is an absolute requirement for the operation
   of Kerberos 5.  If keys are implemented adequate protection from
   unauthorized modification and disclosure MUST be available and
   REQUIRED by the implementation.


5.4  Policy


   Implementations SHOULD implement policy but MAY allow them to be
   OPTIONAL.


5.4.1  Policy: Attributes


5.4.1.1  policyIdentifier


   The policyIdentifier MUST be unique within the local administrative
   context and MUST be globally unique.  Possible types of identifiers
   include:


      An Object Identifier (OID)
      A URN
      A UUID


5.4.1.2  policyIsMandatory


   This attribute indicates that the KDC MUST be able to correctly
   interpret and apply this policy for the key to be used.


5.4.1.3  policyContent


   This is an optional opaque binary value used to store a
   representation of the policy.  In general a policy cannot be fully
   expressed using attribute-value pairs.  The policyContent is OPTIONAL
   in the sense that an implementation MAY use it to store an opaque
   value for those policy-types which are not directly representable in
   that implementation.


5.4.2  Password Quality Policy


5.4.2.1  Password Quality Policy: Attributes


   Password quality policy controls the requirements placed by the KDC
   on new passwords.  TODO: update with information from Nico


5.4.3  Password Management Policy






Johansson              Expires December 30, 2004               [Page 10]
Internet-Draft    An information model for Kerberos version 5  July 2004



5.4.3.1  Password Management Policy: Attributes


   Password management policy controls how passwords are changed.  TODO:
   update with information from Nico and Ludovic


5.4.4  Keying Policy


5.4.4.1  Keying Policy: Attributes


   A keying policy specifies the association of enctypes with new
   principals, i.e when a principal is created one of the possibly many
   applicable keying policies determine the set of keys to associate
   with the principal.  In general the expression of a keying policy may
   require a Touring-complete language.






































Johansson              Expires December 30, 2004               [Page 11]
Internet-Draft    An information model for Kerberos version 5  July 2004



6.  Implementation Scenarios


   There are several ways to implement an administrative service for
   Kerberos 5 based on this information model.  In this section we list
   a few of them.


6.1  LDAP backend to KDC


   Given an LDAP schema implementation of this information model it
   would be possible to build an administrative service by backending
   the KDC to a directory server where principals and keys are stored.
   Using the security mechanisms available on the directory server keys
   are protected from access by anyone apart from the KDC.
   Administration of the principals, policy and other non-key data is
   done through the directory server while the keys are modified using
   the set/change password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd].


6.2  LDAP frontend to KDC


   An alternative way to provide a directory interface to the KDC is to
   implement an LDAP-frontend to the KDC which exposes all non-key
   objects as entries and attributes.  As in the example above all keys
   are modified using the set/change password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd].  In this scenario the
   implementation would typically not use a traditional LDAP
   implementation but treat LDAP as an access-protocol to data in the
   native KDC database.


6.3  SOAP


   Given an XML schema implementation of this information model it would
   be possible to build a SOAP-interface to the KDC.  This demonstrates
   the value of creating an abstract information model which is mappable
   to multiple schema representations.

















Johansson              Expires December 30, 2004               [Page 12]
Internet-Draft    An information model for Kerberos version 5  July 2004



7.  Security Considerations


   This document describes an abstract information model for Kerberos 5.
   The Kerberos 5 protocol depends on the security of the keys stored in
   the KDC.  The model described here assumes that keys MUST NOT be
   transported in the clear over the network and furthermore that keys
   are treated as write-only attributes that SHALL only be modified
   (using the administrative interface) by the change-password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd].


   Exposing the object model of a KDC typically implies that objects can
   be modified and/or deleted.  In a KDC not all principals are created
   equal, so that for instance deleting krbtgt/EXAMPLE.COM@EXAMPLE.COM
   effectively disables the EXAMPLE.COM realm.  Hence access control is
   paramount to the security of any implementation.  This document does
   not (at the time of writing - leifj) mandate access control.  This
   only implies that access control is beyond the scope of the standard
   information model, i.e that access control MAY NOT be accessible via
   any protocol based on this model.  If access control objects is
   exposed via an extension to this model the presence of access control
   may in itself provide points of attack by giving away information
   about principals with elevated rights etc.  etc.






























Johansson              Expires December 30, 2004               [Page 13]
Internet-Draft    An information model for Kerberos version 5  July 2004



8.  Remarks


   A few notes and TODOs:
      Do we want to model access control? I have received a few notes on
      that from Love.  It will affect both the model and the security
      considerations but It may be relevant.  The catch is that most
      implementations (SOAP, LDAP, etc) will have acl mechanisms
      separate from the data which makes modeling acls difficult.
      Perhaps there are certain aspects of access control which can be
      modeled with relative ease - for instance the ability to make an
      object immutable.
      Need to specify how extensions to the model happens.
      Comparison for equality is implied by specifying syntax, but what
      about ordering? Do we need/want to compare objects/
      attribute-values for order?
      Explanatory text on a few of the basic attributes that doesn't
      just repeat the section title.
      Expand on the password policy types.  Is the subdivision into
      quality and management policies valid?


9  References


   [I-D.ietf-krb-wg-kerberos-clarifications]
              Neuman, C., "The Kerberos Network Authentication Service
              (V5)", draft-ietf-krb-wg-kerberos-clarifications-05 (work
              in progress), February 2004.


   [I-D.ietf-krb-wg-kerberos-set-passwd]
              Trostle, J., "Kerberos Set/Change Password: Version 2",
              draft-ietf-krb-wg-kerberos-set-passwd-01 (work in
              progress), October 2003.


   [RFC1510]  Kohl, J. and B. Neuman, "The Kerberos Network
              Authentication Service (V5)", RFC 1510, September 1993.


   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.



Author's Address


   Leif Johansson
   Stockholm university
   Enheten f÷r IT och Media
   Stockholm  SE-106 91


   EMail: leifj@it.su.se
   URI:   http://people.su.se/~leifj/




Johansson              Expires December 30, 2004               [Page 14]
Internet-Draft    An information model for Kerberos version 5  July 2004



Intellectual Property Statement


   The IETF takes no position regarding the validity or scope of any
   intellectual property or other rights that might be claimed to
   pertain to the implementation or use of the technology described in
   this document or the extent to which any license under such rights
   might or might not be available; neither does it represent that it
   has made any effort to identify any such rights.  Information on the
   IETF's procedures with respect to rights in standards-track and
   standards-related documentation can be found in BCP-11.  Copies of
   claims of rights made available for publication and any assurances of
   licenses to be made available, or the result of an attempt made to
   obtain a general license or permission for the use of such
   proprietary rights by implementors or users of this specification can
   be obtained from the IETF Secretariat.


   The IETF invites any interested party to bring to its attention any
   copyrights, patents or patent applications, or other proprietary
   rights which may cover technology that may be required to practice
   this standard.  Please address the information to the IETF Executive
   Director.



Full Copyright Statement


   Copyright (C) The Internet Society (2004).  All Rights Reserved.


   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.


   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assignees.


   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION




Johansson              Expires December 30, 2004               [Page 15]
Internet-Draft    An information model for Kerberos version 5  July 2004



   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.



Acknowledgment


   Funding for the RFC Editor function is currently provided by the
   Internet Society.











































Johansson              Expires December 30, 2004               [Page 16]