Re: KDC model and atomicity

>>>>> "Leif" == Leif Johansson <[email protected]> writes:

    >> Specifically I object to any requirement, particularly any implied 
    >> requirement, that a KDC support atomic operations on principal 
    >> records.  We have never before had such a requirement, and to add
    >> it now for a controversial feature (a DoS, for goodness' sake)
    >> is... not acceptable.

    Leif> I hadn't thought of this aspect. FTR I agree with your objection.
    Leif> _______________________________________________


Leif, I'm confused because I'd like to understand what in the current
text leads to a requirement for atomicity.
The current text has a failed authentications count (and we're adding
one that can be reset).

To me, that means a schema must be able to map to/from that attribute in
the data model.
It's entirely reasonable for a schema to store more information so long
as the mapping exists.
Nico has proposed an excellent mapping of this attribute to LDAP: a list
of failed authentications.
What in the current text prohibits that?
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg