Re: KDC model and atomicity

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 06/26/2012 06:21 PM, Nico Williams wrote:
> On Tue, Jun 26, 2012 at 11:12 AM, Greg Hudson <[email protected]>
> wrote:
>> On 06/26/2012 11:32 AM, Nico Williams wrote:
>>> What text would get ignored?
>> 
>> I expect 4.1.1.5 in its current form wouldn't be interesting to
>> any schema or KDC implementations.  I expect 4.1.1.6 and 4.1.1.7
>> to be ignored by any schema or implementation not trying to do
>> AD-style n-strikes lockout.
> 
> I agree about 4.1.1.5.  Just remove it.  I don't mind specifying 
> attributes that only some server implementors will implement.
> 
>> If we think a schema document is likely to include attributes
>> designed to allow n-strikes lockout, then we should modify
>> 4.1.1.5 (perhaps just removing the last sentence) and leave in
>> 4.1.1.6 and 4.1.1.7.  But the recent conversation suggests that
>> we are not especially likely to do that, in which case the text
>> of 4.1.1.5-7 serves no purpose.
> 
> I'm OK with removing these.  And if there's objections to a 
> principalLocked attribute, then I definitely want these attributes 
> gone.

Now I'm confused. Detecting that a principal is locked (remember that
the spec is silent on ro vs rw) is not in any way related to n-strikes.

I still argue that the simplest change is to make 4.1.1.5-7 OPTIONAL.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk/q1XMACgkQ8Jx8FtbMZneG1wCfb72SMTBLotuO+xemKwG/3Hu0
ObgAn3ZUqJvM6/vAZ5NduXe4/GnblUTl
=ZuFp
-----END PGP SIGNATURE-----
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg