Authentication Indicator in Kerberos Tickets
updates
- rfc-4120 — The Kerberos Network Authentication Service (V5)
Extracted elements (13)
AD-AUTHENTICATION-INDICATOR elements are placed inside AD-CAMMAC containers (rather than bare authorization data) because AD-CAMMAC allows both application services and the KDC to verify authenticity, addressing weaknesses of the older AD-KDC-ISSUED container.
AD-AUTHENTICATION-INDICATOR strings are intended to be used as positive indications that certain requirements were met, not as negative indicators, to avoid ambiguity. For example, a 'without-password' indicator could misleadingly apply to anonymous PKINIT where no authentication occurred at all.
Site-defined indicator strings MUST NOT contain a colon, which distinguishes them from URI-form Level of Assurance Profile references. This allows implementations to unambiguously determine the type of each indicator string.
Authorization data elements of type AD-AUTHENTICATION-INDICATOR MUST be included in an AD-CAMMAC container so that their contents can be verified as originating from the KDC.
Each UTF8String value in AD-AUTHENTICATION-INDICATOR MUST be either a URI referencing a Level of Assurance Profile (RFC 6711) or a site-defined string that MUST NOT contain a colon.
Elements of type AD-AUTHENTICATION-INDICATOR MAY safely be ignored by applications and KDCs that do not implement this element.
The KDC MAY include authorization data of ad-type 97 wrapped in AD-CAMMAC in initial credentials, and MAY copy it from a ticket-granting ticket into service tickets.
AD-AUTHENTICATION-INDICATOR is a new Kerberos authorization data type (ad-type 97) that conveys authentication strength information to application services. Its ad-data field contains the DER encoding of a SEQUENCE OF UTF8String, where each string indicates that a particular set of requirements was met during initial authentication.
Ad-type number 97 is assigned for AD-AUTHENTICATION-INDICATOR, updating the table in Section 7.5.4 of RFC 4120. The table in Section 5.2.6 of RFC 4120 is also updated to map ad-type 97 to 'DER encoding of AD-AUTHENTICATION-INDICATOR'.
Application servers MUST validate the AD-CAMMAC container before making authorization decisions based on AD-AUTHENTICATION-INDICATOR elements, and MUST NOT make authorization decisions based on AD-AUTHENTICATION-INDICATOR elements that appear outside of AD-CAMMAC containers.
Application service evaluation of site-defined indicators MUST consider the realm of original authentication in order to avoid cross-realm indicator collisions. Failure to enforce this property can result in invalid authorization decisions.
KDC implementations MUST use AD-CAMMAC verifiers as described in RFC 7751 to ensure that AD-AUTHENTICATION-INDICATOR elements are not modified by an attacker. AD-CAMMAC supersedes AD-KDC-ISSUED and allows both application services and the KDC to verify the authenticity of the contained authorization data.
The AD-AUTHENTICATION-INDICATOR ad-data field contains the DER encoding (X.690) of the ASN.1 type: AD-AUTHENTICATION-INDICATOR ::= SEQUENCE OF UTF8String. Each UTF8String is a short indicator string not intended to store structured data.