[7825] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Donald T. Davis)
Wed Aug 21 19:25:26 1996
To: kerberos@MIT.EDU
Date: Wed, 21 Aug 1996 19:07:48 -0400
From: "Donald T. Davis" <don@cam.ov.com>
I think it's worth pointing out that the problem is
that post-logout processes need delegated credentials.
krb already has a mechanism for leaving reduced-potency
credentials behind at logout, so that persistent
processes can use them for accesses of restricted scope.
that's what v5 tickets' authorization_data field is for:
to limit the accesses that the tickets are able to
authenticate. if an authorization mechanism were in
place to fill the authz_data field, and if kerberized
applications knew how to enforce the authz_data's
restrictions, the resulting delagated tickets _could_
persist after logout, even by default, without much harm.
then, the logout procedure would clean up non-delegated
tickets, but might leave most delegated tickets in place.
because of their reduced potency, the delegated credentials
would not be very attractive to thieves.
-don davis, boston
