[33703] in Kerberos
Re: how to "ban" clients?
daemon@ATHENA.MIT.EDU (Nico Williams)
Tue Aug 2 15:58:17 2011
MIME-Version: 1.0
In-Reply-To: <201108021647.p72Glspb026979@wind.enjellic.com>
Date: Tue, 2 Aug 2011 14:58:08 -0500
Message-ID: <CAK3OfOigJzALxwYSQn4CL41GBRCK_X3spc-LXjk08+a4Hs4XVQ@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: greg@enjellic.com
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Aug 2, 2011 9:47 AM, <greg@enjellic.com> wrote:
>
> On Jul 27, 12:19pm, Nico Williams wrote:
> > On Tue, Jul 26, 2011 at 6:59 AM, <ghudson@mit.edu> wrote:
> > It'd be nice to have a standard revocation protocol for Kerberos...
>
> We have one, its called authorization.... :-)
Not if we insist on delivering auth z-data via kerberos tickets (see Simo's
PAD proposal.
Also, we don't re-authorize long-lived sessions constantly -- not at all
actually. So, yes IMO we need a low latency revocation protocol.
Nico
--
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
