KERBEROS WORKING GROUP
Internet Engineering Task Force (IETF)                      L. Johansson
Internet-Draft
Request for Comments: 6880                                         SUNET
Intended status:
Category: Standards Track                        January 14, 2013
Expires: July 18,                                     March 2013
ISSN: 2070-1721

              An information model Information Model for Kerberos version Version 5
                     draft-ietf-krb-wg-kdc-model-16

Abstract

   This document describes an information model for Kerberos version 5
   from the point of view of an administrative service.  There is no
   standard for administrating a kerberos Kerberos 5 KDC. Key Distribution Center
   (KDC).  This document describes the services exposed by an
   administrative interface to a KDC.

Status of this This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list  It represents the consensus of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid the IETF community.  It has
   received public review and has been approved for a maximum publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 5741.

   Information about the current status of six months this document, any errata,
   and how to provide feedback on it may be updated, replaced, or obsoleted by other documents obtained at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on July 18, 2013.
   http://www.rfc-editor.org/info/rfc6880.

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

Table of Contents

   1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3 ....................................................3
   2. Requirements notation  . . . . . . . . . . . . . . . . . . . .  4 Notation ...........................................4
   3. Information model demarcation  . . . . . . . . . . . . . . . .  6 Model Demarcation ...................................5
   4. Information model specification  . . . . . . . . . . . . . . .  7 Model Specification .................................6
      4.1. Principal  . . . . . . . . . . . . . . . . . . . . . . . .  7 ..................................................6
           4.1.1. Principal: Attributes  . . . . . . . . . . . . . . . .  7 ...............................6
           4.1.2. Principal: Associations  . . . . . . . . . . . . . . .  8 .............................7
      4.2. KeySet . . . . . . . . . . . . . . . . . . . . . . . . . .  9 .....................................................8
           4.2.1. KeySet: Attributes . . . . . . . . . . . . . . . . . .  9 ..................................8
           4.2.2. KeySet: Associations . . . . . . . . . . . . . . . . .  9 ................................8
      4.3. Key  . . . . . . . . . . . . . . . . . . . . . . . . . . .  9 ........................................................9
           4.3.1. Key: Attributes  . . . . . . . . . . . . . . . . . . . 10 .....................................9
           4.3.2. Key: Associations  . . . . . . . . . . . . . . . . . . 10 ..................................10
           4.3.3. Key: Remarks . . . . . . . . . . . . . . . . . . . . . 11 .......................................10
      4.4. Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 11 ....................................................10
           4.4.1. Policy: Attributes . . . . . . . . . . . . . . . . . . 11 .................................10
           4.4.2.  Mandatory-to-implement Mandatory-to-Implement Policy  . . . . . . . . . . . . 12 ......................11
   5. Implementation Scenarios . . . . . . . . . . . . . . . . . . . 13 .......................................11
      5.1. LDAP backend Backend to KDC  . . . . . . . . . . . . . . . . . . . 13 .......................................12
      5.2. LDAP frontend Frontend to KDC . . . . . . . . . . . . . . . . . . . 13 ......................................12
      5.3. SOAP . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 ......................................................12
      5.4.  Netconf  . . . . . . . . . . . . . . . . . . . . . . . . . 13 NETCONF ...................................................12
   6. Security Considerations  . . . . . . . . . . . . . . . . . . . 14 ........................................12
   7.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
   8. Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 16
   9. ................................................13
   8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17
     9.1. .....................................................13
      8.1. Normative References . . . . . . . . . . . . . . . . . . . 17
     9.2. ......................................13
      8.2. Informative References . . . . . . . . . . . . . . . . . . 17
   Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 18 ....................................14

1.  Introduction

   The Kerberos version 5 authentication service described in [RFC4120]
   describes how a Key Distribution Center (KDC) provides authentication
   to clients.  The standard  RFC 4120 does not stipulate how a KDC is managed managed, and
   several "kadmin" servers have evolved. evolved since RFC 4120 was written.
   This document describes the services required to administer a KDC and
   the underlying information model assumed by a kadmin-type service.

   The information model is written in terms of "attributes" and either
   "services" or "interfaces" "interfaces", but the use of these particular words
   must not be taken to imply any particular modeling paradigm.  Neither
   an
   object oriented object-oriented model nor an LDAP a Lightweight Directory Access Protocol
   (LDAP) [RFC4510] schema is intended.  The author has attempted to describe
   describe, in natural language prose, the intended semantics and syntax of the
   components of the model.  An  For instance, an LDAP schema
   (for instance) based on this
   model will be more precise in the expression of the syntax while
   preserving the semantics of this model.

   Implementations of this document MAY decide to change the names used
   (e.g.
   (e.g., principalName).  If so so, an implementation MUST provide a name to
   name name-
   to-name mapping to this document.  In particular particular, schema languages
   may have different conventions for caseing, eg camelCase vs typographical conventions, e.g., the use of an
   uppercase letter (as seen in camelCase) versus the use of '_' and '-'
   to separate 'words' in a name.  Implementations MUST call out such
   conventions explicitly.

   Implementations of this document MUST be able to support default
   values for attributes as well as and have the ability to specify syntax for
   attribute values.

2.  Requirements notation Notation

   This document uses the standard key words ("MUST", "MUST NOT",
   "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT",
   "RECOMMENDED", "MAY", and "OPTIONAL") that are defined in [RFC2119] [RFC2119],
   but with modifications to those definitions as described below.  The
   reason for this (which was discussed extensively in the kerberos WG) Kerberos
   working group) is as follows:

   This document describes an information model for kerberos 5 Kerberos 5, but it
   does not directly describe any mapping onto a particular schema- schema or
   modelling
   modeling language.  Hence  Hence, an implementation of this model consists
   of a mapping to such a language - e.g. language, e.g., an LDAP or SQL schema.  The
   Therefore, the standard normative key word therefore words require precise definition:
   definition.

   The terms MUST or REQUIRED means "MUST" and "REQUIRED" mean that a schema implementing this
   model must have a way to represent a feature (i.e (i.e., that it is
   mandatory to implement it in schema) the schema), but that that, unless otherwise specified
   specified, the feature may represent an optional element in the
   chosen schema definition language.

   However MUST

   However, "MUST" also means that a KDC or administrative interface
   implementing this information model MUST has to provide the feature and
   associated behavior consistent with the schema.

   For instance, principalLastFailedAuthentication (cf below) principalName (see Section 4.1.1.1) represents the last time an authentication failed for name
   of a principal.  In an LDAP schema (for instance) instance), this may be
   represented as an optional attribute even though all KDCs
   implementing this specification must support this attribute.

   The terms MAY or OPTIONAL means "MAY" and "OPTIONAL" mean that the feature it is optional to
   implement by for a KDC or
   administrative interface implementing this information model.  It model to
   implement this feature.  These terms also means mean that implementing the
   feature is optional to
   implement in schema.

   Implementors the schema is optional.

   Implementers of the schema should be aware that that, unless there is a way to the schema
   definition can represent critical but optional elements in the schema definition elements, language
   confusion may arise when optional elements are used but not
   understood by all implementations in a particular deployment.

   The expression "MUST NOT be OPTIONAL" means that a feature it is mandatory to implement that
   a feature be implemented ("MUST" cf above) per the definition in [RFC2119]) and that
   additionally that it must not be marked as optional in the schema
   language.  In particular particular, this expression means that the feature is
   both mandatory to implement and must be present in all
   representations of the object to which it applies.

   The term SHOULD or RECOMMENDED means terms "SHOULD" and "RECOMMENDED" mean that the consequences of
   not implementing the feature as if it was were described with the "MUST"
   keyword must be carefully weighed before choosing a different course.
   In particular this implies particular, these terms imply that interoperability concerns may
   arise from not following the recommended practice in schema that implements
   implement this model.

   The context

   Context will determine if whether the "SHOULD" key word applies to the
   schema, or to the underlying behaviour behavior of the KDC KDC, or both.  For
   instance, when this document states that principalIsDisabled (cf below) (see
   Section 4.1.1.4) SHOULD default to FALSE FALSE, this statement implies both
   a recommendation for the behaviour behavior of KDCs aswell as well as a rekommendation recommendation
   for the representation of that behaviour behavior in schema.

3.  Information model demarcation Model Demarcation

   The information model specified in the next chapter Section 4 describes objects, properties of those objects their
   properties, and relations the relationships between those the objects.  These
   elements comprise an abstract view of the data represented in a KDC.
   It is important to understand that the information model is not a
   schema.  In particular particular, the way objects are compared for equality
   beyond that which is implied by the specification of a syntax is not
   part of this specification.  Nor specification, nor is the ordering specified between the
   elements of a particular syntax.

   Further work on Kerberos will undoubtedly prompt updates to this
   information model to reflect changes in the functions performed by
   the KDC.  Such extensions to the information model should always use
   a normative reference to the relevant RFCs in detailing the change in
   KDC function.

   This model describes a number of elements related to password policy
   management.  Not all of the elements in this model are unique to
   Kerberos;
   Kerberos.  For example, an LDAP implementation of this model should
   incorporate existing LDAP schema where functional overlap exists,
   rather than defining additional Kerberos-specific elements.

4.  Information model specification Model Specification

4.1.  Principal

   The fundamental entity stored in a KDC is the principal.  The
   Principal
   principal is associated to with keys and generalizes the "user" concept.
   The Principal principal MUST be implemented in full and MUST NOT be OPTIONAL in
   an implementation

4.1.1.  Principal: Attributes

4.1.1.1.  principalName

   The principalName MUST uniquely identify the Principal principal within the
   administrative context of the KDC.  The principalName MUST be
   equivalent to the string representation of the Principal principal name
   (section (see
   Section 2.1.1 of [RFC1964]) [RFC1964]), including, if applicable for the name
   type, the realm.

   The attribute MAY be multi-valued multivalued if the implementation supports
   aliases and/or
   aliases, enterprise names. names, or both.  In that case this case, exactly one of the
   principalName values MAY be designated as the canonical principalName
   and if
   principalName.  If the implementation supports enctypes which encryption types
   (enctypes) that require salt then salt, exactly one of the values of
   principalName MAY be designated as the canonical salting
   principalName.

   Implementations (i.e. (i.e., schema) that support enterprise names and/or
   aliases names,
   aliases, or both, SHOULD provide for efficient lookup of Principal principal
   objects based on alias/enterprise the alias or enterprise name.

4.1.1.2.  principalNotUsedBefore

   The Principal principal MUST NOT be used before this date.  The syntax of the
   attribute MUST be Internet Date/Time Format date/time format from [RFC3339].  The
   attribute MUST be single-valued.

4.1.1.3.  principalNotUsedAfter

   The Principal principal MUST NOT be used after this date.  The syntax of the
   attribute MUST be Internet Date/Time Format date/time format from [RFC3339].  The
   attribute MUST be single-valued.

4.1.1.4.  principalIsDisabled

   A boolean attribute used to disable a Principal. principal.  The attribute
   SHOULD default to boolean FALSE.

4.1.1.5.  principalLastCredentialChangeTime

   This single-valued attribute contains the time of the last successful
   change of credential (e.g. credentials (e.g., password or private key) associated with
   this Principal. principal.  The syntax of the attribute MUST be Internet Date/
   Time Format
   date/time format from [RFC3339].

4.1.1.6.  principalCreateTime

   This single-valued attribute contains the time and date when this
   Principal
   principal was created.  The syntax of the attribute MUST be Internet
   Date/Time Format
   date/time format from [RFC3339].

4.1.1.7.  principalModifyTime

   This single-valued attribute contains the time and date when this
   Principal
   principal was last modified modified, excluding credentials change. changes to credentials.  The
   syntax of the attribute MUST be Internet Date/Time Format date/time format from
   [RFC3339].

4.1.1.8.  principalMaximumTicketLifetime

   This single-valued attribute contains the time time, in seconds seconds,
   representing the maximum lifetime for tickets of a ticket issued for this
   Principal.
   principal.

4.1.1.9.  principalMaximumRenewableTicketLifetime

   This single-valued attribute contains the delta time time, in seconds seconds,
   representing the maximum amount of time a ticket may be renewed for
   this Principal. principal.

4.1.1.10.  principalAllowedEnctype

   This OPTIONAL multi-valued multivalued attribute lists the enctypes allowed for
   this principal.  If empty or absent absent, any enctype supported by the
   implementation is allowed for this Principal. principal.

   This attribute is intended as a policy attribute and restricts all
   uses of enctypes enctypes, including server, client, and session keys.  Data
   models MAY choose to use policy objects in order to represent more
   complex decision mechanisms.

4.1.2.  Principal: Associations

   Each Principal principal MAY be associated with 0 or more KeySet KeySets and MAY be
   associated with 0 or more Policies.  The KeySet is represented as an
   object in this model since model, because it has attributes associated with it
   (the key version number).  In typical situations situations, the Principal principal is
   associated with exactly 1 KeySet one KeySet, but implementations MUST NOT
   assume this case, i.e. case.  That is, an implementation of this standard MUST
   be able to handle the general case of multiple KeySet KeySets associated
   with each principal.  Multiple KeySets may may, for instance instance, be useful
   when performing a key rollover for a principal.

4.2.  KeySet

   In Kerberos Kerberos, principals are associated with zero or more symmetric
   secret keys, and each key has a key version number (kvno) and an
   enctype.  In this model model, we group keys by kvno into KeySet objects.
   A
   Principal principal can have zero or more KeySet objects associated with it,
   each of which MUST have one or more keys.  Each KeySet is associated
   with exactly one principal.  Schemas  A schema derived from this model MAY
   lack a direct analogue of KeySet KeySet, as described in this document.

   It is expected that most Kerberos implementations will use a special-
   purpose interface for setting and changing Principal principal passwords and
   keys.

   If a server supports an enctype for a Principal principal, that enctype must be
   present in at least one key for the Principal principal in question.  For any
   given enctype enctype, a KeySet MUST NOT contain more than one Key key with that
   enctype.

   The security of Kerberos 5 depends absolutely on the confidentiality
   and integrity of the Key key objects stored in the KDC.  Implementations
   of this standard MUST facilitate, to the extent possible, an
   administrator's ability to place more restrictive access controls on
   KeySets than on other Principal principal data, and to arrange for more secure
   backup for KeySets.

4.2.1.  KeySet: Attributes

4.2.1.1.  kvno

   Also knowns as the

   The key version number.  This is a single-valued attribute containing
   a non-negative integer.  This number is
   incremembed incremented by one each time
   a key in the KeySet is changed.

4.2.2.  KeySet: Associations

   To each

   Each KeySet MUST be associated with a set of 1 one or more Keys.

4.3.  Key

   Implementations of this model MUST NOT REQUIRE force keys to be represented.
   That is, a schema that REQUIRED a key to be present would not meet
   this constraint.

4.3.1.  Key: Attributes

4.3.1.1.  keyEncryptionType

   The enctype SHOULD be represented as an enumeration of the enctypes
   supported by the KDC using the string name ("encryption type") of the
   enctype from the IANA registry of Kerberos Encryption Type Numbers.
   One example is 'aes128-cts-hmac-sha1-96'. "aes128-cts-hmac-sha1-96".

4.3.1.2.  keyValue

   The binary representation of the key data.  This MUST be a single-
   valued octet string.

4.3.1.3.  keySaltValue

   The binary representation of the key salt.  This MUST be a single-
   valued octet string.

4.3.1.4.  keyStringToKeyParameter

   This MUST be a single-valued octet string representing an opaque
   parameter associated with the enctype.  This parameter is specified
   in
   using the "string-to-key" string-to-key method defined in section Section 3 of [RFC3961].

4.3.1.5.  keyNotUsedBefore

   This

   The key MUST NOT be used before this date.  The syntax of the
   attribute MUST be semantically equivalent with to the standard ISO date
   format.
   format ([RFC3339]).  This attribute MUST be a single-valued attribute. single-valued.

4.3.1.6.  keyNotUsedAfter

   This

   The key MUST NOT be used after this date.  The syntax of the
   attribute MUST be semantically equivalent with to the standard ISO date
   format.
   format ([RFC3339]).  This attribute MUST be a single-valued attribute. single-valued.

4.3.1.7.  keyIsDisabled

   This is a boolean attribute which that SHOULD be set to false FALSE by default.
   If this attribute is true TRUE, the key MUST NOT be used.  This  The
   keyIsDisabled attributed is used to temporarily disable a key.

4.3.2.  Key: Associations

   None

4.3.3.  Key: Remarks

   The security of the keys is an absolute requirement for the operation
   of Kerberos 5.  If keys are implemented implemented, adequate protection from
   unauthorized modification and disclosure MUST be available and is
   REQUIRED by of the implementation.

4.4.  Policy

   Implementations SHOULD implement policy policies, but MAY allow them to be
   OPTIONAL.  The Policy policy should be thought of as a 'typed hole'. i.e. "typed hole", i.e.,
   as an opaque binary value paired with an identifier of the type of
   data contained in the binary value.  Both attributes (type and value)
   must be present.

4.4.1.  Policy: Attributes

4.4.1.1.  policyIdentifier

   The policyIdentifier MUST be globally unique.  Possible types of
   identifiers include:

   o  An Object Identifier (OID) [RFC4517]

   o  A URI [RFC3986]

   o  A UUID [RFC4122]

   Implementations of this specification are expected to assign globally
   unique identifiers to the list of the standard policy below in
   accordance with best-practice best practices for identifier-management identifier management for the schema-language
   schema language used.

4.4.1.2.  policyIsCritical

   This boolean attribute indicates that the KDC MUST be able to
   correctly interpret and apply this the policy for the Principal principal to be
   used.

4.4.1.3.  policyContent

   This is an optional single opaque binary value is used to store a
   representation of the policy.  In general general, a policy cannot be fully
   expressed using attribute-value pairs.  The policyContent is OPTIONAL
   in the sense that an implementation MAY use it to store an opaque
   value for those policy-types which the policy types that are not directly representable in
   that implementation.

4.4.1.4.  policyUse

   This is an optional single enumerated string value is used to describe the
   use of the policy.  Implementations SHOULD provide this attribute and
   MUST (if the attribute is implemented) describe the enumerated set of
   possible values.  The intent is that this attribute be useful
   in providing provide an
   initial context-based filtering.

4.4.2.  Mandatory-to-implement  Mandatory-to-Implement Policy

   All implementations that represent Policy policy objects MUST be able to
   represent the policies listed in this section.  Implementations are
   not required to use the same underlying data-representation data representation for the
   policyContent binary value value, but SHOULD use the same OIDs as the
   policyIdentifier.  In general general, the expression of policy may require a
   Turing-complete language.  This specification does not attempt to
   model policy expression policy-expression language.

4.4.2.1.  Password Quality Policy

   Password quality policy controls the requirements placed by the KDC
   on new passwords.

4.4.2.2.  Password Management Policy

   Password management policy controls how passwords are changed.

4.4.2.3.  Keying Policy

   A keying policy specifies the association of enctypes with new
   principals, e.g.
   principals.  For example, when a Principal principal is created created, one of the
   applicable keying policies is used to determine the set of keys to
   associate with the principal.

4.4.2.4.  Ticket Flag Policy

   A ticket flag policy specifies the ticket flags allowed for tickets
   issued for a principal.

5.  Implementation Scenarios

   There are several ways to implement an administrative service for
   Kerberos 5 based on this information model.  In this section section, we list
   a few of them.

5.1.  LDAP backend Backend to KDC

   Given an LDAP schema implementation of this information model model, it
   would be possible to build an administrative service by back-ending backending
   the KDC to a directory server where principals and keys are stored.
   Using the security mechanisms available on the directory directory, server keys
   are protected from access by anyone apart from the KDC.
   Administration of the principals, policy, and other non-key data is
   done through the directory server server, while the keys are modified using
   the set/change password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd]. [PASSWORD].

5.2.  LDAP frontend Frontend to KDC

   An alternative way to provide a directory interface to the KDC is to
   implement an LDAP-frontend LDAP frontend to the KDC which that exposes all non-key
   objects as entries and attributes.  As in the example above above, all keys
   are modified using the set/change password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd]. [PASSWORD].  In
   this scenario scenario, the implementation would typically not use a
   traditional LDAP
   implementation implementation, but would treat LDAP as an access a protocol
   to access data in the native KDC database.

5.3.  SOAP

   Given an XML schema implementation of this information model model, it
   would be possible to build a SOAP interface to the KDC.  This
   situation demonstrates the value of creating an abstract information
   model which that is mappable to multiple schema representations.

5.4.  Netconf  NETCONF

   Given a YAML (YAML Ain't Markup Language) implementation of this
   information model model, it would be possible to create a Netconf-based NETCONF-based
   interface to the KDC, enabling management of the KDC from standard
   network management applications.

6.  Security Considerations

   This document describes an abstract information model for Kerberos 5.
   The Kerberos 5 protocol depends on the security of the keys stored in
   the KDC.  The model described here assumes that keys MUST NOT be
   transported in the clear over the network and furthermore that keys
   are
   be treated as write-only attributes that SHALL only be modified (using the
   administrative interface) only by the change-password protocol
   [I-D.ietf-krb-wg-kerberos-set-passwd].
   [PASSWORD].

   Exposing the object model of a KDC typically implies that objects can
   be modified and/or deleted. modified, deleted, or both.  In a KDC KDC, not all principals are
   created
   equal, so that for instance equal.  For instance, deleting krbtgt/EXAMPLE.COM@EXAMPLE.COM
   effectively disables the EXAMPLE.COM realm.  Hence  Hence, access control is
   paramount to the security of any implementation.  This document does
   not mandate access control.  This only situation implies only that access
   control is beyond the scope of the standard information model, i.e. i.e.,
   that access control may not be accessible via any protocol based on
   this model.  If access control objects are exposed via an extension
   to this model model, the presence of access control may in itself provide
   points of attack by giving away information about principals with that
   have elevated rights etc. rights.

7.  IANA Considerations

   This document has no IANA actions.

8.  Acknowledgments

   The author wishes to extend his thanks to Love Hoernquist-Aestrand
   and Sam Hartman for their important contributions to this document.

9.

8.  References

9.1.

8.1.  Normative References

   [RFC1964]  Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC
              1964, June 1996.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

   [RFC3339]  Klyne, G., Ed. and C. Newman, "Date and Time on the
              Internet: Timestamps", RFC 3339, July 2002.

   [RFC3961]  Raeburn, K., "Encryption and Checksum Specifications for
              Kerberos 5", RFC 3961, February 2005.

   [RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
              Resource Identifier (URI): Generic Syntax", STD 66, RFC
              3986, January 2005.

   [RFC4120]  Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
              Kerberos Network Authentication Service (V5)", RFC 4120,
              July 2005.

   [RFC4122]  Leach, P., Mealling, M., and R. Salz, "A Universally
              Unique IDentifier (UUID) URN Namespace", RFC 4122, July
              2005.

   [RFC4517]  Legg, S., "Lightweight Directory Access Protocol (LDAP):
              Syntaxes and Matching Rules", RFC 4517, June 2006.

9.2.

8.2.  Informative References

   [I-D.ietf-krb-wg-kerberos-set-passwd]

   [PASSWORD]
              Williams, N., "Kerberos Set/Change Key/Password Protocol
              Version 2", draft-ietf-krb-wg-kerberos-set-passwd-08 (work Work in progress), Progress, November 2008.

   [RFC4510]  Zeilenga, K., "Lightweight Directory Access Protocol
              (LDAP): Technical Specification Road Map", RFC 4510, June
              2006.

Author's Address

   Leif Johansson
   Swedish University Network
   Thulegatan 11
   Stockholm

   Email:
   Sweden

   EMail: leifj@sunet.se
   URI:   http://www.sunet.se