Re: The usability of service ticket lifetimes
Tom Yu <[email protected]> Tue, 21 Aug 2012 17:17:57 -0400
| Newsgroups | gmane.ietf.krb-wg |
|---|---|
| Message-ID | <[email protected]> |
"Henry B. Hotz" <[email protected]> writes: > On Aug 21, 2012, at 1:33 PM, Jeffrey Altman wrote: > >> Your rule assumes that policy changes are enforced upon TGT renewals and >> my rule assumes that policy changes are enforced upon all ticket >> renewals. I hope that policy changes are enforced during the issuance >> of all tickets and not just TGTs. > > Are there any currently deployed implementations which will directly renew service tickets? I've always thought the concept of a renewable non-tgt was counter to the design. RFC 1510 section 3.3.2 makes it clear that the KDC can renew a non-TGT service ticket. Whether that's a good idea is debatable, but it does appear to be part of the original design. _______________________________________________ ietf-krb-wg mailing list [email protected] https://lists.anl.gov/mailman/listinfo/ietf-krb-wg