kerberos identity syntax

[Leif Johansson <leifj@it.su.se>]

I believe that the syntax for kerberosID in the acl draft does not
accurately reflect all possible forms of a principal. It would be
better to refer to section 7 of RFC 1510 where the various forms of
principal names are listed. Note that one possible form of princpal
names are directory distinguished names which cannot be matched 
using caseIgnoreMatch. This would seem to make caseIgnoreMatch a
poor choice for aci matchingrule.

	Cheers,

Leif Johansson				Phone: +46 8 164541		
Department of Mathematics		Fax  : +46 8 6126717		
Stockholm University 			email: leifj@matematik.su.se 	

    <This space is left blank for quotational and disclamatory purposes.>