Re: The usability of service ticket lifetimes

Tom Yu <[email protected]> wrote:

>"Henry B. Hotz" <[email protected]> writes:
>
>> On Aug 21, 2012, at 1:33 PM, Jeffrey Altman wrote:
>>
>>> Your rule assumes that policy changes are enforced upon TGT renewals
>and
>>> my rule assumes that policy changes are enforced upon all ticket
>>> renewals.  I hope that policy changes are enforced during the
>issuance
>>> of all tickets and not just TGTs.
>>
>> Are there any currently deployed implementations which will directly
>renew service tickets?  I've always thought the concept of a renewable
>non-tgt was counter to the design.
>
>RFC 1510 section 3.3.2 makes it clear that the KDC can renew a non-TGT
>service ticket.  Whether that's a good idea is debatable, but it does
>appear to be part of the original design.

Of course, a KDC my choose not to renew a ticket.  But, issuing a renewable ticket which one has no intention of ever renewing is in poor taste.
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg