Subject: Re: [Ietf-krb-wg] kerberos-referrals issue: caching and lifetime of referral info

From: Ken Raeburn <[email-masked]>
Date: Tue, 16 Oct 2007 20:22:45 -0400

Back in April, I sent email around concerning the caching of referral  
information, and discussing whether the TGT expiration time could or  
should be used to convey this.

The one response I received was from Jeff Altman:

> Ken:
>
> You are correct in saying that the two expiration times are not
> logically connected.  Beyond that I believe that using the expiration
> time of the ticket to communicate the lifetime of the referral is  
> going
> to prove troublesome.   Some KDC implementations restrict the lifetime
> of the ticket being issued to the endtime of the ticket being  
> presented.
> This behavior does not match that described in RFC 4120 but it is  
> widely
> deployed.

> As a result, a cross-realm TGT with an endtime that has been  
> restricted
> to communicate the lifetime of the referral information would have a
> significant impact on the lifetime of tickets issued in response to
> receiving such a TGT.
>
> If we wish to communicate the lifetime of referral info, we should  
> do so
> independent of the existing ticket endtime.

One of the suggestions I made was that a separate "referral-valid- 
until" field could be defined, but optional, defaulting to the  
expiration time of the TGT.  That provides for shorter encoding, but  
costs a little more code complexity.

Unless I hear more feedback, I'll update the document to add the  
field, and make it required.

Ken
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg