Re: Question: Prefer to block on draft-ietf-krb-wg-kdc-model

On Thu, 2012-06-28 at 14:22 -0500, Nico Williams wrote:
> On Thu, Jun 28, 2012 at 1:35 PM, Leif Johansson <[email protected]> wrote:
> >> I'd be OK with adding a locked attribute.
> >
> > I'm ok removing them or making them optional. I believe that
> > introducing locking will entail a substantial rewrite of the
> > spec which I think is not worth the effort at this point. Maybe
> > next revision!
> 
> I'm talking about a locked attribute with no special semantics to read
> nor write.  It'd be deleting the principal to lock and re-creating the
> principal to unlock, say, or deleting its keys and re-creating them,
> or setting a disallow-tix flag, only, of course, simpler than that.
> Speaking of which, I don't see that MIT krb5 attribute in the I-D
> (disallow-tix).

It's 4.1.1.4, principalIsDisabled

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg