RFC 8129

Authentication Indicator in Kerberos Tickets

📅 published March 2017, from ietf

Authentication Indicator in Kerberos Tickets ✨

Okay so, here's the tea 🫖💖 This is RFC 8129, and it's a Standards Track document from March 2017 that updates RFC 4120. It was written by A. Jain (Georgia Tech), N. Kinder, and N. McCallum (both Red Hat, Inc.). The ISSN is 2070-1721. It's giving official, and we're here for it 💅

The whole point is adding a new authorization data type called AD-AUTHENTICATION-INDICATOR, so that tickets can carry a little badge showing how strongly the client was authenticated. Then application services can use that badge as an input into their policy decisions. Main character energy, literally 🦋

Abstract ✨

Bestie, this doc is an extension to the Kerberos protocol, so it updates RFC 4120 🎀 It defines the brand new authorization data type AD-AUTHENTICATION-INDICATOR. The goal is to pop an indicator of the strength of a client's authentication into service tickets, so app services can use it as an input into policy decisions. It's so good 😭🫶

Status of This Memo 🌸

This is an Internet Standards Track document. ✨

It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check out Section 2 of RFC 7841 🧚

Info about the current status of this document, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc8129 💜

Copyright Notice 🔥

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication. Please review these carefully, because they describe your rights and restrictions. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License. Read the fine print, babe 🙈

Table of Contents 🍓

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Document Conventions  . . . . . . . . . . . . . . . . . . . .   2
3.  AD Type Specification . . . . . . . . . . . . . . . . . . . .   2
4.  Assigned Numbers  . . . . . . . . . . . . . . . . . . . . . .   3
5.  Security Considerations . . . . . . . . . . . . . . . . . . .   3
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   4
  7.1.  Normative References  . . . . . . . . . . . . . . . . . .   4
  7.2.  Informative References  . . . . . . . . . . . . . . . . .   5
Appendix A.  ASN.1 Module . . . . . . . . . . . . . . . . . . . .   6
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   6
Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   6

1. Introduction 🧚

Okay so [RFC4120] is the Kerberos thing that lets users and services talk securely over a network 🔐 It supports a bunch of authentication mechanisms through its pre-authentication framework [RFC6113]. The Kerberos authentication service was built to handle password-based auth, multi-factor auth with one-time password devices, public-key crypto, and other pre-authentication schemes.

Implementations offering pre-authentication mechanisms with significantly different strengths of client authentication may choose to track how strong the authentication was, so it can be used as an input into policy decisions. Lowkey iconic 👑

This document specifies a new authorization data type that conveys authentication strength information to application services. Its elements show up inside an AD-CAMMAC (Authorization Data type Container Authenticated by Multiple Message Authentication Codes) [RFC7751] container 🎀

2. Document Conventions 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [RFC2119]. Those are the official vibes, so take them seriously ✨

3. AD Type Specification 🦋

The Key Distribution Center (KDC) MAY include authorization data of ad-type 97, wrapped in AD-CAMMAC, in initial credentials. The KDC MAY copy it from a ticket-granting ticket into service tickets. Okay, optional but fun 🌸

The corresponding ad-data field contains the DER encoding [X.690] of the following ASN.1 [X.680] type:

AD-AUTHENTICATION-INDICATOR ::= SEQUENCE OF UTF8String

Each UTF8String value is a short string saying that a particular set of requirements was met during the initial authentication. These strings are meant to be compared against known values, not to store structured data, so don't get creative with them 🙈

Each string MUST be either:

A URI that references a Level of Assurance Profile [RFC6711], or
A site-defined string, which MUST NOT contain a colon, whose meaning is determined by the realm administrator.

Authorization data elements of type AD-AUTHENTICATION-INDICATOR MUST be included in an AD-CAMMAC container so their contents can be verified as coming from the KDC 🔥 Elements of type AD-AUTHENTICATION-INDICATOR MAY safely be ignored by applications and KDCs that don't implement this element. No drama 💖

4. Assigned Numbers 🍓

RFC 4120 [RFC4120] is updated in the following ways:

The ad-type number 97 is assigned for AD-AUTHENTICATION-INDICATOR, updating the table in Section 7.5.4 of RFC 4120 [RFC4120].
The table in Section 5.2.6 of RFC 4120 [RFC4120] is updated to map the ad-type 97 to "DER encoding of AD-AUTHENTICATION-INDICATOR".

5. Security Considerations 💀

Okay bestie, this part is SERIOUS 😭 Elements of type AD-AUTHENTICATION-INDICATOR are wrapped in AD-CAMMAC containers. AD-CAMMAC supersedes AD-KDC-ISSUED and lets both application services and the KDC verify the authenticity of the contained authorization data 🛡️

KDC implementations MUST use AD-CAMMAC verifiers as described in the security considerations of RFC 7751 [RFC7751] to ensure that AD-AUTHENTICATION-INDICATOR elements are not modified by an attacker. Application servers MUST validate the AD-CAMMAC container before making authorization decisions based on AD-AUTHENTICATION-INDICATOR elements. Application servers MUST NOT make authorization decisions based on AD-AUTHENTICATION-INDICATOR elements that appear outside of AD-CAMMAC containers. Do not skip this, no cap 🚫

Using multiple strings in AD-AUTHENTICATION-INDICATOR may lead to ambiguity when a service tries to make a decision based on those values. That ambiguity can be avoided if indicator values are always used as a positive indication that certain requirements were met during the initial authentication. For example, if a "without-password" indicator is inserted whenever authentication occurs without a password, a service might assume this means a higher-strength client authentication occurred. However, this indicator might also be inserted when no authentication occurred at all (such as anonymous PKINIT) 🙃

Application service evaluation of site-defined indicators MUST consider the realm of original authentication in order to avoid cross-realm indicator collisions. Failure to enforce this property can result in invalid authorization decisions. Protect your decisions, periodt 💅✨

6. IANA Considerations 🌈

This document does not require any IANA actions. Easy peasy 🧚

7. References 📚

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC4120]  Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
           Kerberos Network Authentication Service (V5)", RFC 4120,
           DOI 10.17487/RFC4120, July 2005,
           <http://www.rfc-editor.org/info/rfc4120>.

[RFC6113]  Hartman, S. and L. Zhu, "A Generalized Framework for
           Kerberos Pre-Authentication", RFC 6113,
           DOI 10.17487/RFC6113, April 2011,
           <http://www.rfc-editor.org/info/rfc6113>.

[RFC7751]  Sorce, S. and T. Yu, "Kerberos Authorization Data
           Container Authenticated by Multiple Message Authentication
           Codes (MACs)", RFC 7751, DOI 10.17487/RFC7751, March 2016,
           <http://www.rfc-editor.org/info/rfc7751>.

[X.680]    ITU-T, "Information technology -- Abstract Syntax Notation
           One (ASN.1): Specification of basic notation", ITU-T
           Recommendation X.680, ISO/IEC International Standard
           8824-1:2008, November 2008.

[X.690]    ITU-T, "Information technology -- ASN.1 encoding rules:
           Specification of Basic Encoding Rules (BER), Canonical
           Encoding Rules (CER) and Distinguished Encoding Rules
           (DER)", ITU-T Recommendation X.690, ISO/IEC International
           Standard 8825-1:2008, November 2008.

7.2. Informative References

[RFC6711]  Johansson, L., "An IANA Registry for Level of Assurance
           (LoA) Profiles", RFC 6711, DOI 10.17487/RFC6711, August
           2012, <http://www.rfc-editor.org/info/rfc6711>.

Appendix A. ASN.1 Module 🧚

KerberosV5AuthenticationIndicators {
        iso(1) identified-organization(3) dod(6) internet(1)
        security(5) kerberosV5(2) modules(4)
        authentication-indicators(9)
} DEFINITIONS EXPLICIT TAGS ::= BEGIN

AD-AUTHENTICATION-INDICATOR ::= SEQUENCE OF UTF8String

END

Acknowledgements 🫶

Huge shoutout to Dmitri Pal (Red Hat), Simo Sorce (Red Hat), and Greg Hudson (MIT) 💜

Authors' Addresses 💌

Anupam Jain Georgia Tech 225 North Ave NW Atlanta, GA 30332 United States of America

Email: ajain323@gatech.edu

Nathan Kinder Red Hat, Inc. 444 Castro St. Suite 500 Mountain View, CA 94041 United States of America

Email: nkinder@redhat.com

Nathaniel McCallum Red Hat, Inc. 100 East Davie Street Raleigh, NC 27601 United States of America

Email: npmccallum@redhat.com

📦 where this page comes from

ietf: rfc8129 2017-03
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms