Re: KDC model and atomicity

I'm in favor of a "locked" attribute, and a reset operation.  There's clearly no consensus for anything beyond that.

On Jun 26, 2012, at 9:21 AM, Nico Williams wrote:

> On Tue, Jun 26, 2012 at 11:12 AM, Greg Hudson <[email protected]> wrote:
>> On 06/26/2012 11:32 AM, Nico Williams wrote:
>>> What text would get ignored?
>> 
>> I expect 4.1.1.5 in its current form wouldn't be interesting to any
>> schema or KDC implementations.  I expect 4.1.1.6 and 4.1.1.7 to be
>> ignored by any schema or implementation not trying to do AD-style
>> n-strikes lockout.
> 
> I agree about 4.1.1.5.  Just remove it.  I don't mind specifying
> attributes that only some server implementors will implement.
> 
>> If we think a schema document is likely to include attributes designed
>> to allow n-strikes lockout, then we should modify 4.1.1.5 (perhaps just
>> removing the last sentence) and leave in 4.1.1.6 and 4.1.1.7.  But the
>> recent conversation suggests that we are not especially likely to do
>> that, in which case the text of 4.1.1.5-7 serves no purpose.
> 
> I'm OK with removing these.  And if there's objections to a
> principalLocked attribute, then I definitely want these attributes
> gone.
> 
> Nico
> --
> _______________________________________________
> ietf-krb-wg mailing list
> [email protected]
> https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email protected], or [email protected]

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg