A new Request for Comments is now available in online RFC libraries.
RFC 5896
Title: Generic Security Service Application Program
Interface (GSS-API): Delegate if Approved by
Policy
Author: L. Hornquist Astrand, S. Hartman
Status: Standards Track
Stream: IETF
Date: June 2010
Mailbox: [email protected],
[email protected]
Pages: 6
Characters: 12846
Updates/Obsoletes/SeeAlso: None
I-D Tag: draft-lha-gssapi-delegate-policy-05.txt
URL: http://www.rfc-editor.org/rfc/rfc5896.txt
Several Generic Security Service Application Program Interface
(GSS-API) applications work in a multi-tiered architecture, where the
server takes advantage of delegated user credentials to act on behalf
of the user and contact additional servers. In effect, the server
acts as an agent on behalf of the user. Examples include web
applications that need to access e-mail or file servers, including
CIFS (Common Internet File System) file servers. However, delegating
the user credentials to a party who is not sufficiently trusted is
problematic from a security standpoint. Kerberos provides a flag
called OK-AS-DELEGATE that allows the administrator of a Kerberos
realm to communicate that a particular service is trusted for
delegation. This specification adds support for this flag and
similar facilities in other authentication mechanisms to GSS-API (RFC
2743). [STANDARDS TRACK]
This is now a Proposed Standard Protocol.
STANDARDS TRACK: This document specifies an Internet standards track
protocol for the Internet community,and requests discussion and suggestions
for improvements. Please refer to the current edition of the Internet
Official Protocol Standards (STD 1) for the standardization state and
status of this protocol. Distribution of this memo is unlimited.
This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
http://www.ietf.org/mailman/listinfo/ietf-announce
http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist
For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html.
For downloading RFCs, see http://www.rfc-editor.org/rfc.html.
Requests for special distribution should be addressed to either the
author of the RFC in question, or to [email protected]. Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.
The RFC Editor Team
Association Management Solutions, LLC
_______________________________________________
IETF-Announce mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/ietf-announce
