Re: KDC model and atomicity

On Fri, 2012-06-22 at 13:23 -0500, Nico Williams wrote:
> I care for the minimum interop we can get here without being too
> prescriptive w.r.t. implementation.  I don't mind saying that there
> must be a read-write lock attribute that can be used to unlock
> principals locked by N-strikes.

That's too strong.  It presumes that such a policy is implemented and in
use.  Also, the reason I suggested that such an attribute might be
write-only is that in an implementation where lockout is done
independently by each KDC, it may not be possible for any one entity to
tell you whether a principal has been locked out.



>   I don't mind saying that there may be (MAY, not SHOULD, and
> certainly not MUST, implement on the server side) a read-only
> strike-count attribute (clients can be required to implement, but not
> servers, or if they can be required to  then they must explicitly be
> allowed to not support N-strikes.  I'm also OK with a variety of other
> optional attributes (again ,perhaps must implement for clients, but
> not servers) for the alternative policies that we discussed.

I suggested three specific attributes, with specific semantics.  In my
proposal, each of these would be read-only and optional.  The idea here
is that KDCs would implement the attributes corresponding to the
counters they actually have, which probably means at most one of the
three counters I described.  Clients, of course, would have to support
all three, so as to be able to report this information.  The reason for
having three separate attributes is so that clients can tell, based on
which attribute is reported, what the value means.

Note again that this is about management.  Nothing should be required
here unless it is something that actually needs to exist and be exposed
for management and monitoring _for every KDC_.  So, don't require an
attribute that makes sense only if the KDC implements some particular
policy.

-- Jeff


_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg