Re: KDC model and atomicity

On Tue, Jun 26, 2012 at 11:12 AM, Greg Hudson <[email protected]> wrote:
> On 06/26/2012 11:32 AM, Nico Williams wrote:
>> What text would get ignored?
>
> I expect 4.1.1.5 in its current form wouldn't be interesting to any
> schema or KDC implementations.  I expect 4.1.1.6 and 4.1.1.7 to be
> ignored by any schema or implementation not trying to do AD-style
> n-strikes lockout.

I agree about 4.1.1.5.  Just remove it.  I don't mind specifying
attributes that only some server implementors will implement.

> If we think a schema document is likely to include attributes designed
> to allow n-strikes lockout, then we should modify 4.1.1.5 (perhaps just
> removing the last sentence) and leave in 4.1.1.6 and 4.1.1.7.  But the
> recent conversation suggests that we are not especially likely to do
> that, in which case the text of 4.1.1.5-7 serves no purpose.

I'm OK with removing these.  And if there's objections to a
principalLocked attribute, then I definitely want these attributes
gone.

Nico
--
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg