CORBA34 — Issue: CSIv2 Identity Assertion

Issue on Document orbos/2000-08-04, CSIv2 Joint Submission

Document: orbos/2000-08-04, CSIv2 Joint Submission
Subject: Identity Assertion of X.501 Distinguished Name is not good enough
Severity: Critical

Summary:

The Identity Token union contains a branch that is labled
X501DistinguishedName. A single DN is insufficient to identify an entity.
A path of X501Distinguished Names is needed instead. Also, other concerns
about naming types are raised.

Discussion:

An X.501 Distinguished Name is insufficient to identify a single entity.
The name must be accompanied by the name of its defining authority. In the
case of public key certificates, the names certificate authority must be
included.

The chain of DNs in this manner must be included up to a root authority
to have any definitive meaning.

This approach will be consistent with the client sending a X.509
Certificate Chain. A DN path is actually defined by the certificate chain.

Furthermore, the DN path should only come from an authority that is
acceptable to the server, whether it be a DN path, or an X.509
Certificate Chain.

The IOR should list the acceptable authorities and their name types.

It is becoming more an more evident that we must invent GSS_NT_Export_Name
types for X.509 Certificate Chain and X.501 DN path.

The SAS_ContextSec structure should list, instead of the naming types,
the naming authorities!

We shall assume that the name types of the asserted identities shall be
the same as the name types of listed naming authorities in the IOR.

This is the only way this procedure can work Interoperable and without
the client Guessing what it should do.

Suggestions:

An OID for an X.509 Public Key Certificate Chain shall be defined for a
GSS Export Name, and its encoding will be a ASN1 sequence of and X.509
certificate with the least significant certificate first.

An OID for an X.501 Distinguished Name Path shall be defined for a GSS
Exported Name, and its encoding shall be an ASN1 sequence of an X.501
Distinguished Name with the least significant name first.

To avoid having the target put a whole certificate chain in its IOR,
a new OID shall be allocated in which its GSS Exported Name encoding is a
X.501 DN path, but stipulates that the client should send a certificate
chain from that named authority. This GSS Exported Name shall only be
used in IORs and not for transmission in the Identity Token.

typedef Security::GSS_NT_ExportedName NamingAuthority;

struct CompoundSecMech

;

Deferred

This proposal was generated automatically by request of the Task Force Chair Adam Mitz.