RFC 927

RFC 927: TACACS User Identification Telnet Option 🎀

Bestie, here's the deets 💅 Author: Brian A. Anderson at BBN. Date: December 1984. Category: a proposed protocol for the ARPA-Internet community (see the Status section below). Obsoletes/Updates: nothing is listed in this copy 🫶

Status of This Memo 💅

This RFC suggests a proposed protocol for the ARPA-Internet community, and it's asking for discussion and suggestions for improvements. Distribution of this memo is unlimited 🌸

Introduction ✨

Okay so this is a TELNET option that helps with double login avoidance 🔥 It's mainly meant for TAC connections to target hosts on behalf of TAC users, but literally any two hosts that agree can use it. For example, all the hosts at one site (like BBN) can use it so they don't make you log in twice when you TELNET between them 😭💜

1. Command name and code 🦋

TUID     26

2. Command Meanings 👑

IAC WILL TUID

The sender (the TELNET user) proposes to authenticate the user and send the identifying UUID. Or, the sender (the TELNET user) agrees to authenticate the user on whose behalf the connection is initiated. It's giving teamwork 🫶

IAC WON'T TUID

The sender (the TELNET user) refuses to authenticate the user on whose behalf the connection is initiated. Hard pass 🙈

IAC DO TUID

The sender (the TELNET server) proposes that the recipient (the TELNET user) authenticate the user and send the identifying UUID. Or, the sender (the TELNET server) agrees to accept the recipient's (the TELNET user's) authentication of the user identified by his UUID ✨

IAC DON'T TUID

The sender (the TELNET server) refuses to accept the recipient's (the TELNET user's) authentication of the user. Not me, not today 💀

Subnegotiation

The sender (the TELNET user) sends the UUID of the user on whose behalf the connection is established to the host it's connected to. The UUID is a 32 bit binary number 🧚

IAC SB TUID <uuid> IAC SE

3. Default 🍓

WON'T TUID

A TELNET user host (the initiator of a TELNET connection) that isn't implementing or using the TUID option will reply WON'T TUID to a DO TUID. Lowkey the polite no 🌈

DON'T TUID

A TELNET server host (the recipient of a TELNET connection) that isn't implementing or using the TUID option will reply DON'T TUID to a WILL TUID. Same energy, other side 💖

4. Motivation for the Option 💜

Under TACACS (the TAC Access Control System), a user has to be authenticated (give a correct name/password pair) to a TAC before they can connect to a host through the TAC. To avoid a second authentication by the target host, the TAC can pass along the user's proven identity (their UUID) to that host. Hosts can accept the TAC's authentication of the user or not, totally at their option. Main character choice 👑

The same option can be used between any pair of cooperating hosts for double login avoidance. Iconic, honestly 🔥

5. Description for the Option 🌸

When a host sets up a TELNET connection for a user to another host, the other host (if it supports the TUID option and wants to receive the user's UUID) sends an IAC DO TUID to the user's host. If the user's host supports the TUID option and wants to authenticate the user by sending the user's UUID, it responds with IAC WILL TUID. Otherwise, it responds with IAC WON'T TUID ✨

If both the user and server TELNETs agree, the user TELNET then sends the UUID to the server TELNET using sub-negotiation 🫶

6. Examples 🧚

There are two possible negotiations that end in double login avoidance authentication of a user. Both the server and the user TELNET support the TUID option. Slay 💅

S = Server, U = User

Case 1:

S-> IAC DO TUID
U-> IAC WILL TUID
U-> IAC SB TUID <32-bit UUID> IAC SE

Case 2:

U-> IAC WILL TUID
S-> IAC DO TUID
U-> IAC SB TUID <32-bit UUID> IAC SE

There are also two possible negotiations that do not result in authenticating a user. In the first one, the server supports TUID but the user TELNET doesn't. In the second one, the user TELNET supports TUID but the server TELNET doesn't. Not the vibe 💀

S = Server, U = User

Case 3:

S-> IAC DO TUID
U-> IAC WONT TUID

Case 4:

U-> IAC WILL TUID
S-> IAC DONT TUID

The TUID gets sent with the subnegotiation command. For example, if the UUID had the value 1, this string of octets would be sent:

IAC SB TUID 0 0 0 1 IAC SE

If the UUID had the value 255, this string of octets would be sent:

IAC SB TUID 0 0 0 IAC IAC IAC SE

If the UUID had the value of all ones, this string of octets would be sent:

IAC SB TUID IAC IAC IAC IAC IAC IAC IAC IAC IAC SE

---

Heads up: this copy has no References, IANA Considerations, or Security Considerations sections, so there's nothing extra to pass along there 🙈