Re: KDC model and atomicity

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> To me, that means a schema must be able to map to/from that
> attribute in the data model. It's entirely reasonable for a schema
> to store more information so long as the mapping exists. Nico has
> proposed an excellent mapping of this attribute to LDAP: a list of
> failed authentications. What in the current text prohibits that?

Because if you need it to be reset at each successful authn then
if C(lient) talks to K1 and first fails n-1 times, then succeeds
once and fails once and if K2 receives status updates from K1 then
if the message about the success arrives after the message about
the last failure then a mgmt client talking to K2 could lock
the user before the success message arrived at K2 to reset the
counter. I'm not sure how mapping the attribute helps there...

	Cheers Leif

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/YjkIACgkQ8Jx8FtbMZne2agCfdCyB7QeDGgRYAG4GQo2oUU6S
tjYAniFtk9n92ZkdxMaO+FnPC5A0ai+d
=PMuV
-----END PGP SIGNATURE-----
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg