Subject: [Ietf-krb-wg] functional division of KDC model attributes

From: Tom Yu <[email-masked]>
Date: Thu, 31 Jul 2008 06:16:06 -0400

I believe existing KDC implementations use per-principal attributes
for multiple purposes.  It would be useful to divide these by their
function.

Some attributes directly relate to how the KDC issues tickets.  These
include but are not limited to:

* max lifetime

* enabled/disabled for some purpose

* if/which preauth is required

* allowable ticket flags, e.g. postdated, forwardable...

* password expiration date

Some attributes only relate to the administration and management of
principals.  These include but are not limited to:

* password quality policies

* who is allowed to do what to this principal

* who has done what and when to this principal

There might be reasons to store these sets of attributes separately
from each other.  The actual KDC process would only need to access the
first set, and the second set would be used only by administrative
processes.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg