Re: The usability of service ticket lifetimes

On 8/21/2012 2:49 PM, Jeffrey Hutzelman wrote:
> On Tue, 2012-08-21 at 13:21 -0400, Jeffrey Altman wrote:
>> Especially,
>> when the TGT is renewable and the service ticket is renewable.
> 
> But these conditions do not always obtain, and a KDC processing a
> service ticket renewal does not have the TGT to examine.  In fact, the
> client may not have the TGT to renew.

I'm going to break up the thread into sub-threads based on the issues
raised by Jeff Hutzelman's response.

What are the policy semantics of a service ticket that is marked as
RENEWABLE?

If the realm's policy is that obtaining a service ticket with a longer
lifetime must require the possession of the TGT, that is is really easy
to enforce:

  Remove the allow renewable property from the service principal's
  entry in the database.

But if the service principal does permit the issuance of RENEWABLE
service tickets, shouldn't that mean that those tickets can be renewed
without the TGT?  What else could it possibly mean?

RFC 4120 is very ambiguous in this area.

Jeffrey Altman

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iQEcBAEBAgAGBQJQM+9hAAoJENxm1CNJffh4CfQH/iwaeJKyOshRTUdpVexnBo9D
qQ4AnPM07fmKwZls84H056lb6oAIyi4nzWdJWvjbCpZ3pGMeFzq7pXJglQLZtw4J
6YeFGTG3weTt24wQwBQwCxP4kKfLfm9gZZ/O6xXhLSja79eP5KeCE8JioIepMyf9
/iKAb1FIiG/Gt4pqyxqPjmryPUJqImWt5AkhvwiHuaqO6szjIQQfsocqRBr/5PYk
f2AUSjunDIwAeKdWzYfQjAEOerzI9m7KPeh0C71yesCM46Wi8+vaBGQ0/UMQygCt
19T/sXzh/dhVz5j0ULeQiV0K7Or26f4ETAfs9GvVWnd1zidgb4Z0ljOMJMRlG48=
=EhgT
-----END PGP SIGNATURE-----