RFC 6880

An Information Model for Kerberos Version 5

📅 published March 2013, from ietf

RFC 6880 💖 An Information Model for Kerberos Version 5

Okay bestie, here's the key info before we dive in ✨

Number: RFC 6880
Title: An Information Model for Kerberos Version 5
Author: L. Johansson, SUNET 🦋
Stream: Internet Engineering Task Force (IETF)
Category: Standards Track, so this is an official Internet Standard 👑
Date: March 2013
ISSN: 2070-1721
Obsoletes / Updates: the title block doesn't list anything it obsoletes or updates

Abstract 🌸

So this doc is about an information model for Kerberos version 5, seen from the point of view of an administrative service. Here's the tea: there's no standard for administering a Kerberos 5 Key Distribution Center (KDC) 😭 This document fills that gap by describing the services an administrative interface exposes to a KDC. Iconic, honestly.

Status of This Memo 📜

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community, received public review, and was approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.

For the current status, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc6880.

Copyright Notice ⚖️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License.

This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have granted the IETF Trust the right to allow modifications outside the IETF Standards Process. So unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English.

Table of Contents 🗂️

1. Introduction ....................................................3
2. Requirements Notation ...........................................4
3. Information Model Demarcation ...................................5
4. Information Model Specification .................................6
   4.1. Principal ..................................................6
        4.1.1. Principal: Attributes ...............................6
        4.1.2. Principal: Associations .............................7
   4.2. KeySet .....................................................8
        4.2.1. KeySet: Attributes ..................................8
        4.2.2. KeySet: Associations ................................8
   4.3. Key ........................................................9
        4.3.1. Key: Attributes .....................................9
        4.3.2. Key: Associations ..................................10
        4.3.3. Key: Remarks .......................................10
   4.4. Policy ....................................................10
        4.4.1. Policy: Attributes .................................10
        4.4.2. Mandatory-to-Implement Policy ......................11
5. Implementation Scenarios .......................................11
   5.1. LDAP Backend to KDC .......................................12
   5.2. LDAP Frontend to KDC ......................................12
   5.3. SOAP ......................................................12
   5.4. NETCONF ...................................................12
6. Security Considerations ........................................12
7. Acknowledgments ................................................13
8. References .....................................................13
   8.1. Normative References ......................................13
   8.2. Informative References ....................................14

1. Introduction 🎀

Okay, so the Kerberos version 5 authentication service in [RFC4120] explains how a Key Distribution Center (KDC) provides authentication to clients. But RFC 4120 doesn't say how a KDC is managed, and several "kadmin" servers have popped up since RFC 4120 was written. This document covers the services you need to administer a KDC, plus the underlying information model that a kadmin-type service assumes. 💅

The information model is written in terms of "attributes" and either "services" or "interfaces". Those particular words must not be taken to imply any specific modeling paradigm, though. It's not an object-oriented model, and it's not meant to be a Lightweight Directory Access Protocol (LDAP) [RFC4510] schema either. The author describes the intended semantics and syntax in prose. An LDAP schema based on this model will be more precise about syntax while keeping the same semantics, which is very on-brand for it 🧚

Implementations of this document MAY decide to change the names used (e.g., principalName). If they do, an implementation MUST provide a name-to-name mapping to this document. Schema languages may have different typographical conventions, like using an uppercase letter (as in camelCase) versus using _ and - to separate words in a name. Implementations MUST call out such conventions explicitly 📣

Implementations of this document MUST be able to support default values for attributes, and they MUST have the ability to specify syntax for attribute values 🍓

2. Requirements Notation 📐

This document uses the standard key words ("MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL") defined in [RFC2119]. But the definitions are modified as described below, and the reason is a big deal: the Kerberos working group talked about it at length 🗣️

This document describes an information model for Kerberos 5, but it doesn't directly describe any mapping onto a particular schema or modeling language. So an implementation of this model is a mapping to such a language, like an LDAP or SQL schema. That's why the standard normative key words need precise definitions.

The terms "MUST" and "REQUIRED" mean that a schema implementing this model must have a way to represent a feature. In other words, it's mandatory to implement it in the schema. Unless otherwise specified, though, the feature may be an optional element in the chosen schema definition language.

"MUST" also means that a KDC or administrative interface implementing this information model has to provide the feature and the associated behavior, consistent with the schema.

For example, principalName (see Section 4.1.1.1) represents the name of a principal. In an LDAP schema, for instance, it may be represented as an optional attribute, even though every KDC implementing this specification must support it.

The terms "MAY" and "OPTIONAL" mean that it's optional for a KDC or administrative interface implementing this information model to implement the feature. These terms also mean that implementing the feature in the schema is optional.

Schema implementers should be aware that, unless the schema definition can represent critical but optional elements, language confusion can arise. That happens when optional elements are used but not understood by all implementations in a particular deployment 🙈

The expression "MUST NOT be OPTIONAL" means that a feature MUST be implemented ("MUST" per the definition in [RFC2119]), and it must also not be marked as optional in the schema language. Basically, the feature is both mandatory to implement and must be present in all representations of the object it applies to.

Heads up, bestie: "MUST NOT be OPTIONAL" is the strongest version of this. The feature is required in the implementation AND in every schema representation. No wiggle room 💀

The terms "SHOULD" and "RECOMMENDED" mean that the consequences of not implementing the feature as if it were described with the "MUST" keyword must be carefully weighed before choosing a different course. These terms also imply that interoperability concerns may come up if you don't follow the recommended practice in a schema that implements this model.

Context decides whether the "SHOULD" key word applies to the schema, to the underlying behavior of the KDC, or to both. For example, when this document says that principalIsDisabled (see Section 4.1.1.4) SHOULD default to FALSE, that statement recommends both the behavior of KDCs and how that behavior is represented in the schema ✨

3. Information Model Demarcation 🗺️

The information model in Section 4 describes objects, their properties, and the relationships between those objects. These elements give an abstract view of the data represented in a KDC. It's really important to get that the information model is not a schema. The way objects are compared for equality, beyond what's implied by a syntax specification, is not part of this specification. Neither is the ordering between the elements of a particular syntax 🙅‍♀️

More work on Kerberos will definitely prompt updates to this information model to reflect changes in what the KDC does. Those extensions should always use a normative reference to the relevant RFCs when detailing the change in KDC function.

This model describes a number of elements related to password policy management. Not all of them are unique to Kerberos. For example, an LDAP implementation of this model should bring in existing LDAP schema where the functions overlap, instead of defining new Kerberos-specific elements. Don't reinvent the wheel, babe 🛞

4. Information Model Specification 💎

4.1. Principal 👑

The fundamental entity stored in a KDC is the principal. The principal is associated with keys, and it generalizes the "user" concept. The principal MUST be implemented in full and MUST NOT be OPTIONAL in an implementation

4.1.1. Principal: Attributes

4.1.1.1. principalName

The principalName MUST uniquely identify the principal within the administrative context of the KDC. It also MUST be equivalent to the string representation of the principal name (see Section 2.1.1 of [RFC1964]), including, if applicable for the name type, the realm.

The attribute MAY be multivalued if the implementation supports aliases, enterprise names, or both. In that case, exactly one of the principalName values MAY be designated as the canonical principalName. If the implementation supports encryption types (enctypes) that require salt, exactly one of the values of principalName MAY be designated as the canonical salting principalName. Tons of options, bestie, but they all have rules 🧁

Implementations (i.e., schema) that support enterprise names, aliases, or both SHOULD provide efficient lookup of principal objects based on the alias or enterprise name. That way, finding the right principal is fast and easy 🦋

4.1.1.2. principalNotUsedBefore 🕰️

okay so the principal MUST NOT be used before this date 🙅‍♀️ the syntax of this attribute MUST be Internet date/time format from [RFC3339] 💅 and it MUST be single-valued ✨

4.1.1.3. principalNotUsedAfter 🌙

same energy but backwards 💀 the principal MUST NOT be used after this date. the syntax MUST be Internet date/time format from [RFC3339] 🎀 and it MUST be single-valued 🦋

4.1.1.4. principalIsDisabled 🚫

this one is a boolean that's used to disable a principal 🔌 it SHOULD default to boolean FALSE 🌸 so, like, your principal's chill unless you say otherwise 🫶

4.1.1.5. principalLastCredentialChangeTime 🔐

single-valued attribute that holds the time of the last successful change of credentials (think password or private key) tied to this principal 🗝️ its syntax MUST be Internet date/time format from [RFC3339] ⏰

4.1.1.6. principalCreateTime 🎂

single-valued attribute with the time and date when this principal was created 🍰 the syntax MUST be Internet date/time format from [RFC3339] 📅

4.1.1.7. principalModifyTime ✏️

single-valued attribute with the time and date when this principal was last modified 💅 BUT changes to credentials don't count here (those live in principalLastCredentialChangeTime) 🙃 syntax MUST be Internet date/time format from [RFC3339] 🌈

4.1.1.8. principalMaximumTicketLifetime 🎟️

single-valued attribute holding the time, in seconds, for the maximum lifetime of a ticket issued for this principal ⏳✨

4.1.1.9. principalMaximumRenewableTicketLifetime 🔁

single-valued attribute holding the delta time, in seconds, for how long a ticket may be renewed for this principal 🧚 it's the cap on renewals, basically 💜

4.1.1.10. principalAllowedEnctype 🧩

this OPTIONAL multivalued attribute lists the enctypes allowed for this principal 📋 if it's empty or absent, then any enctype the implementation supports is allowed for this principal 🌟

this one is a policy attribute, so it restricts ALL uses of enctypes, including server, client, and session keys 👑 data models MAY choose to use policy objects to represent more complex decision mechanisms 🦋

4.1.2. Principal: Associations 🤝

each principal MAY be associated with 0 or more KeySets and MAY be associated with 0 or more Policies 🎀 the KeySet is an object in this model, because it has attributes attached to it (the key version number) 🔢 usually a principal has exactly one KeySet, but implementations MUST NOT assume that 🙅‍♀️ an implementation of this standard MUST be able to handle the general case of multiple KeySets per principal 💖 multiple KeySets can be super useful when you're doing a key rollover for a principal 🔄

4.2. KeySet 🗝️

in Kerberos, principals are associated with zero or more symmetric secret keys, and each key has a key version number (kvno) and an enctype 🧾 in this model we group keys by kvno into KeySet objects 📦 a principal can have zero or more KeySet objects, and each of those MUST have one or more keys 🔑 each KeySet is associated with exactly one principal 🫶 a schema derived from this model MAY lack a direct analogue of KeySet, as described in this document 🌸

it's expected that most Kerberos implementations will use a special-purpose interface for setting and changing principal passwords and keys 🛠️

if a server supports an enctype for a principal, that enctype must be present in at least one key for the principal in question ✅ for any given enctype, a KeySet MUST NOT contain more than one key with that enctype 🙅‍♀️

the security of Kerberos 5 depends absolutely on the confidentiality and integrity of the key objects stored in the KDC 🚨 implementations of this standard MUST facilitate, to the extent possible, an administrator's ability to place more restrictive access controls on KeySets than on other principal data, and to arrange for more secure backup for KeySets 🔒 this is not a drill, bestie 💀

4.2.1. KeySet: Attributes 🏷️

4.2.1.1. kvno 🔢

the key version number 💜 it's a single-valued attribute holding a non-negative integer 🌈 this number goes up by one each time a key in the KeySet is changed 📈

4.2.2. KeySet: Associations 🔗

each KeySet MUST be associated with a set of one or more Keys 🗂️

4.3. Key 🔑

implementations of this model MUST NOT force keys to be represented 🙅‍♀️ so a schema that REQUIRED a key to be present wouldn't meet this constraint 🙈

4.3.1. Key: Attributes 🧾

4.3.1.1. keyEncryptionType 🔐

the enctype SHOULD be represented as an enumeration of the enctypes the KDC supports, using the string name ("encryption type") of the enctype from the IANA registry of Kerberos Encryption Type Numbers 📚 one example is "aes128-cts-hmac-sha1-96" 🍓

4.3.1.2. keyValue 🧁

the binary representation of the key data 💾 this MUST be a single-valued octet string 🫧

4.3.1.3. keySaltValue 🧂

the binary representation of the key salt 🧂✨ this MUST be a single-valued octet string 🌸

4.3.1.4. keyStringToKeyParameter 🪄

this MUST be a single-valued octet string representing an opaque parameter associated with the enctype 🎁 the parameter is specified using the string-to-key method defined in Section 3 of [RFC3961] 📖

4.3.1.5. keyNotUsedBefore ⏳

the key MUST NOT be used before this date 🙅‍♀️ the syntax of this attribute MUST be semantically equivalent to the standard ISO date format ([RFC3339]) 📅 and it MUST be single-valued 💜

4.3.1.6. keyNotUsedAfter 🌅

the key MUST NOT be used after this date 🙅‍♀️ the syntax MUST be semantically equivalent to the standard ISO date format ([RFC3339]) 📆 and it MUST be single-valued 🎀

4.3.1.7. keyIsDisabled 🚫

this is a boolean attribute that SHOULD be set to FALSE by default 🌷 if it's TRUE, the key MUST NOT be used 🙅‍♀️ keyIsDisabled attributed is used to temporarily disable a key 🧊

4.3.2. Key: Associations 🔗

None

4.3.3. Key: Remarks 📝

the security of the keys is an absolute requirement for operating Kerberos 5 😭 if keys are implemented, adequate protection from unauthorized modification and disclosure MUST be available, and is REQUIRED of the implementation 🔒 no cap, this part is serious 💀

4.4. Policy 📜

implementations SHOULD implement policies, but MAY allow them to be OPTIONAL 🎀 think of a policy as a "typed hole", meaning an opaque binary value paired with an identifier of the type of data inside that binary value 🕳️✨ both attributes (type and value) must be present 💅

4.4.1. Policy: Attributes 🧾

4.4.1.1. policyIdentifier 🆔

the policyIdentifier MUST be globally unique 🌍 possible types of identifiers include:

An Object Identifier (OID) [RFC4517]
A URI [RFC3986]
A UUID [RFC4122]

implementations of this specification are expected to assign globally unique identifiers to the list of standard policies below, following best practices for identifier management for the schema language being used 🧠✨

4.4.1.2. policyIsCritical 🚨

this boolean attribute indicates that the KDC MUST be able to correctly interpret and apply the policy for the principal to be used 🧠 no skipping this one, babe 💅

4.4.1.3. policyContent 📦

this optional single opaque binary value stores a representation of the policy 🎁 in general, a policy can't be fully expressed using attribute-value pairs 🙃 the policyContent is OPTIONAL in the sense that an implementation MAY use it to store an opaque value for policy types that aren't directly representable in that implementation 🫧

4.4.1.4. policyUse 🧭

this optional single enumerated string value describes the use of the policy 🗺️ implementations SHOULD provide this attribute, and MUST (if the attribute is implemented) describe the enumerated set of possible values 📋 the goal is to give an initial context-based filter 🌈

4.4.2. Mandatory-to-Implement Policy 🏆

all implementations that represent policy objects MUST be able to represent the policies listed in this section 👑 implementations don't have to use the same underlying data representation for the policyContent binary value, but they SHOULD use the same OIDs as the policyIdentifier 🆔 in general, expressing policy might need a Turing-complete language 🤯 this specification doesn't try to model a policy-expression language, so don't worry about that 🙈

4.4.2.1. Password Quality Policy 🔐

password quality policy controls the requirements the KDC places on new passwords 💪

4.4.2.2. Password Management Policy 🔄

password management policy controls how passwords are changed 🔁

4.4.2.3. Keying Policy 🗝️

a keying policy specifies the association of enctypes with new principals 🧩 for example, when a principal is created, one of the applicable keying policies is used to decide which set of keys gets associated with that principal 🎀

4.4.2.4. Ticket Flag Policy 🎫

a ticket flag policy specifies the ticket flags allowed for tickets issued for a principal 🏳️‍🌈

5. Implementation Scenarios 🌟

there are several ways to implement an administrative service for Kerberos 5 based on this information model 🧁 here are a few of them ✨

5.1. LDAP Backend to KDC 🗄️

given an LDAP schema implementation of this information model, you could build an administrative service by backending the KDC to a directory server where principals and keys are stored 📂 using the security mechanisms available on the directory, server keys are protected from access by anyone apart from the KDC 🔒 administration of principals, policy, and other non-key data happens through the directory server, while keys are modified using the set/change password protocol [PASSWORD] 🔑

5.2. LDAP Frontend to KDC 🪞

another way to give the KDC a directory interface is to implement an LDAP frontend to the KDC that exposes all non-key objects as entries and attributes 🧾 like the example above, all keys are modified using the set/change password protocol [PASSWORD] 🔐 in this scenario, the implementation would typically not use a traditional LDAP implementation, but would treat LDAP as a protocol for accessing data in the native KDC database 🧠✨

5.3. SOAP 🫧

given an XML schema implementation of this information model, you could build a SOAP interface to the KDC 💌 this situation shows off the value of creating an abstract information model that can be mapped to multiple schema representations 🌈

5.4. NETCONF 🛰️

given a YAML (YAML Ain't Markup Language) implementation of this information model, you could create a NETCONF-based interface to the KDC 🧚 that would let you manage the KDC from standard network management applications 💖

6. Security Considerations ✨

okay bestie, this section is SERIOUS but also kind of iconic 💅 The model in this doc describes an abstract information model for Kerberos 5, and Kerberos 5 totally depends on the keys stored in the KDC 🔐 So keys MUST NOT be sent in the clear over the network 🙅‍♀️ and they're meant to be treated as write-only attributes. They SHALL only be modified through the administrative interface, and only by the change-password protocol [PASSWORD] 🎀

Exposing a KDC's object model usually means objects can be modified, deleted, or both 😭 And not every principal is equal, babe 👑 Deleting krbtgt/EXAMPLE.COM@EXAMPLE.COM effectively disables the EXAMPLE.COM realm 💀 So access control is literally paramount to the security of any implementation 🫶

This document does not mandate access control 🙈 That just means access control is outside the scope of this standard information model. It may not be reachable through any protocol based on this model. And if access control objects get exposed through an extension to this model, the mere presence of access control can itself be an attack point, because it gives away info about principals with elevated rights 😬 main character villain energy, not the vibe 🦋

7. Acknowledgments 🌸

The author wants to thank Love Hoernquist-Aestrand and Sam Hartman for their important contributions to this document 🫶💜

8. References 📚

8.1. Normative References 🌈

[RFC1964] Linn, J., "The Kerberos Version 5 GSS-API Mechanism", RFC 1964, June 1996. 🧚
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 💖
[RFC3339] Klyne, G., Ed. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, July 2002. ⭐
[RFC3961] Raeburn, K., "Encryption and Checksum Specifications for Kerberos 5", RFC 3961, February 2005. 🔐
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005. 🔗
[RFC4120] Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The Kerberos Network Authentication Service (V5)", RFC 4120, July 2005. 🦋
[RFC4122] Leach, P., Mealling, M., and R. Salz, "A Universally Unique IDentifier (UUID) URN Namespace", RFC 4122, July 2005. 🍓
[RFC4517] Legg, S., "Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules", RFC 4517, June 2006. 🎀

8.2. Informative References 💜

[PASSWORD] Williams, N., "Kerberos Set/Change Key/Password Protocol Version 2", Work in Progress, November 2008. 🔑
[RFC4510] Zeilenga, K., "Lightweight Directory Access Protocol (LDAP): Technical Specification Road Map", RFC 4510, June 2006. 🗺️

Author's Address 🧚

Leif Johansson Swedish University Network Thulegatan 11 Stockholm Sweden

EMail: leifj@sunet.se URI: http://www.sunet.se

That's the whole thing, bestie!! 🌈✨ You made it through all of RFC 6880 🫶 Iconic behaviour, no cap 💅

📦 where this page comes from

ietf: rfc6880 2013-03
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms