Re: KDC model and atomicity

On Wed, 2012-06-13 at 14:57 +0200, Leif Johansson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> > To me, that means a schema must be able to map to/from that
> > attribute in the data model. It's entirely reasonable for a schema
> > to store more information so long as the mapping exists. Nico has
> > proposed an excellent mapping of this attribute to LDAP: a list of
> > failed authentications. What in the current text prohibits that?
> 
> Because if you need it to be reset at each successful authn then
> if C(lient) talks to K1 and first fails n-1 times, then succeeds
> once and fails once and if K2 receives status updates from K1 then
> if the message about the success arrives after the message about
> the last failure then a mgmt client talking to K2 could lock
> the user before the success message arrived at K2 to reset the
> counter. I'm not sure how mapping the attribute helps there...

FWIW we currently do note replicate the account lock/success status in
our LDAP setups, because it completely kills replication infrastructure.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg