[7849] in Kerberos
Re: destruction of Kerberos credentials upon logout
daemon@ATHENA.MIT.EDU (Sam Hartman)
Fri Aug 23 14:13:05 1996
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: Sam Hartman <hartmans@MIT.EDU>, kerberos@MIT.EDU
From: Sam Hartman <hartmans@MIT.EDU>
Date: 23 Aug 1996 13:56:16 -0400
In-Reply-To: Ken Hornstein's message of Fri, 23 Aug 1996 11:51:50 -0400
>>>>> "K" == Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:
Ken> Would it really belong in libdefaults? Maybe [defaults], eh?
>>
>> I would say appdefaults, but yes, this is more reasonable than
>> having a separate default for each application. Forwarding really
>> ought to be controlled on a realm-by-realm basis, though. I have very
>> little control over other realms' DNS and may not wish to trust that
>> I'm connecting to the host I think I'm connecting to.
K> Okay, how about something along the lines of this (based on the Cygnus stuff):
K> [appdefaults]
K> forward = false
K> forwardable = false
K> autologin = true
K> encrypted = true
K> ATHENA.MIT.EDU = {
K> forward = true
K> forwardable = true
K> encrypted = false
K> }
Two points. First, you want to separate kinit from everything
else. There are many times I want to get forwardable tickets but
don't always want to forward. Second, I think my misjudge the default
Athena would choose for encryption. =)
I like the format. I would like to wait to see what Cygnus is
going to do before writing any code myself. If they plan on
contributing what they have so far, it would probably be worth
minimizing differences.
However, I think Cygnus is fairly busy these days, and
naturally support their customers is a higher priority than giving MIT
code. So I'm not sure what their timeframe is. If you need this
quickly, you may end up doing it yourself.
K> --Ken
