Re: KDC model and atomicity
Nico Williams <[email protected]> Fri, 22 Jun 2012 13:23:46 -0500
| Newsgroups | gmane.ietf.krb-wg |
|---|---|
| Message-ID | <CAK3OfOgpiFojd=A=6GLj9bVWakFtjps_5D11D1y9ceVKbUW_Fw@mail.gmail.com> |
I care for the minimum interop we can get here without being too prescriptive w.r.t. implementation. I don't mind saying that there must be a read-write lock attribute that can be used to unlock principals locked by N-strikes. I don't mind saying that there may be (MAY, not SHOULD, and certainly not MUST, implement on the server side) a read-only strike-count attribute (clients can be required to implement, but not servers, or if they can be required to then they must explicitly be allowed to not support N-strikes. I'm also OK with a variety of other optional attributes (again ,perhaps must implement for clients, but not servers) for the alternative policies that we discussed. Nico -- _______________________________________________ ietf-krb-wg mailing list [email protected] https://lists.anl.gov/mailman/listinfo/ietf-krb-wg