[35828] in Kerberos
Re: Request to change MIT Kerberos behavior when principal is
daemon@ATHENA.MIT.EDU (Nico Williams)
Thu Mar 6 15:38:12 2014
MIME-Version: 1.0
In-Reply-To: <4DE25DED585CD840A23808AFDE3DA2060151212C@RPITSEXMS4.its.uncc.edu>
Date: Thu, 6 Mar 2014 14:37:54 -0600
Message-ID: <CAK3OfOgGq9FEMmNBp_s_wfekKg6KByHeUEFFKgSZwcnsH6u94Q@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: "Edgecombe, Jason" <jwedgeco@uncc.edu>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Thu, Mar 6, 2014 at 1:31 PM, Edgecombe, Jason <jwedgeco@uncc.edu> wrote:
> Does Heimdal reject requests for expired/disabled accounts as well?
It rejects in these cases:
- the HDB doesn't have an entry for the client principal but should have
- the HDB did have an entry and the client principal was marked locked out
- the HDB did have an entry and the client principal was marked invalid
- the HDB did have an entry and the client principal was marked not a client
- the HDB did have an entry and the client principal's valid_start
(which is only really supported via the LDAP HDB backend)
- the HDB did have an entry and the client principal requires a password change
- the HDB did have an entry and the client principal's password is expired
It'd be trivial to reject requests using tickets predating the last
password change.
Nico
--
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
