Re: KDC model and atomicity

On Mon, Jun 11, 2012 at 8:44 AM, Sam Hartman <[email protected]> wrote:
> Leif, I'm confused because I'd like to understand what in the current
> text leads to a requirement for atomicity.

The failed authentication count attribute.  I suppose we could say
that it's a virtual attribute whose value may be computed from other
sources, then there'd be no atomicity implication.

> To me, that means a schema must be able to map to/from that attribute in
> the data model.

Resetting a virtual failed auth count attribute sounds more like an
operation in LDAP speak than like a modify.  I suppose nothing in the
LDAP specs forbids this, but note that it may not be possible to
explicitly assign any value other than zero to this attribute.

> It's entirely reasonable for a schema to store more information so long
> as the mapping exists.

That's a fair point.

Nico
--
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg