[35833] in Kerberos
Re: Request to change MIT Kerberos behavior when principal is expired,
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Mar 7 18:17:08 2014
Message-ID: <531A5364.6020409@mit.edu>
Date: Fri, 07 Mar 2014 18:16:52 -0500
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: "Edgecombe, Jason" <jwedgeco@uncc.edu>
In-Reply-To: <4DE25DED585CD840A23808AFDE3DA20601513D9E@RPITSEXMS4.its.uncc.edu>
Cc: "'kerberos@mit.edu'" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 03/07/2014 05:17 PM, Edgecombe, Jason wrote:
> I don't see how anyone can object to rejecting requests for expired or deleted principals.
I don't think anyone has. In the past I have mentioned performance as a
possible issue, but it turns out we have been looking up the client
entry for most TGS requests since 1.7, so that's not a concern.
The change may not be a trivial one to make safely, because there are so
many edge cases in modern TGS request processing.
Be aware that:
* We cannot generally do these checks for cross-realm TGS requests.
* The KDC cannot revoke already-issued service tickets.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
