Re: The usability of service ticket lifetimes

On Aug 21, 2012, at 3:09 PM, Nico Williams wrote:

> On Tue, Aug 21, 2012 at 12:21 PM, Jeffrey Altman
> <[email protected]> wrote:
>> As part of any revision to RFC 4120, I would like to see this section
>> modified.
> 
> Note that some client libraries check that the KDC does not exceed the
> limits you quoted.  That means that relaxing them will require a KDC
> options flag in the request...  And it should only be used in KDC-REQs
> where the body of the request is protected (e.g., TGS-REQs and AS-REQs
> in a FAST tunnel).
> 
> Nico

IMO it's inappropriate (as in: a *bug*) for a client to unconditionally enforce limits which are the KDCs responsibility to enforce.  If nothing else, it makes it hard to support edge cases which may violate some letters of the limits, but not the intent or the policy.  (I suppose I'm a bit twitchy due to a PKINIT issue I ran into recently.)

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email protected], or [email protected]

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg