Subject: [Ietf-krb-wg] Changes to PIN change support in draft-ietf-krb-wg-otp-preauth-09

From: [email-masked]
Date: Mon, 1 Dec 2008 11:30:41 -0500

Following Larry's review of the OTP pre-auth ID, I had a short
discussion with Henry Hotz off-list about his proposed changes to the
wording of section 2.3 regarding when the KDC should return a
PA-OTP-PIN-CHANGE.  

Three changes were discussed:

1) Update the wording of the second paragraph in section 2.3 regarding
when a PA-OTP-PIN-CHANGE should be returned by the KDC.

      If during the authentication process, the KDC determines that the
      user's PIN has been changed then it SHOULD include a
      PA-OTP-PIN-CHANGE in the response as described in Section 2.3.  If
it
      determines that the user's PIN has expired then it MAY return a
      PA-OTP-PIN-CHANGE, otherwise it SHOULD  return the same response
as 
      for a non-OTP expired password.

2) Change the final paragraph in the same section to not assume that a
TGT is returned

   If the user's PIN has been changed and the KDC is returning the new
   value to the user then no such restrictions are required and the KDC
   SHOULD return the originally requested ticket.

3) Add LastReq field from section 4.5.2 of RFC4120 to the
PA-OTP-PIN-CHANGE with lr-types of 6 and possibly 7 permitted. This is
to allow for communication of when the OTP PIN and account will expire.

 	PA-OTP-PIN-CHANGE ::= SEQUENCE {
 	  flags         PinFlags,
 	  pin           UTF8String OPTIONAL,
 	  minLength     INTEGER    OPTIONAL,
 	  maxLength [1] INTEGER    OPTIONAL,
 	  last-req	    LastReq    OPTIONAL,
 	  ...
 	}

Unless anyone has any objections, I'll go ahead and make these changes.

--Gareth
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg