Subject: [Ietf-krb-wg] Fwd: New Version Notification for draft-ietf-krb-wg-kdc-model-05

From: Leif Johansson <[email-masked]>
Date: Fri, 31 Jul 2009 14:07:22 +0200

I think its time to last call this - I upped a new (very minor nits) version 
since I saw that the last version was about to expire.

	Cheers Leif

Subject: New Version Notification for draft-ietf-krb-wg-kdc-model-05
From: IETF I-D Submission Tool <[email-masked]>
To: [email-masked]
Date: Fri, 31 Jul 2009 05:03:59 -0700 (PDT)

A new version of I-D, draft-ietf-krb-wg-kdc-model-05.txt has been successfuly submitted by Leif Johansson and posted to the IETF repository.

Filename:	 draft-ietf-krb-wg-kdc-model
Revision:	 05
Title:		 An information model for Kerberos version 5
Creation_date:	 2009-07-31
WG ID:		 krb-wg
Number_of_pages: 18

Abstract:
This document describes an information model for Kerberos version 5
from the point of view of an administrative service.  There is no
standard for administrating a kerberos 5 KDC.  This document
describes the services exposed by an administrative interface to a
KDC.

The IETF Secretariat.

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Howard Chu <[email-masked]>
Date: Fri, 31 Jul 2009 13:02:50 -0700

> since I saw that the last version was about to expire.

Some notes from my LDAP Schema review....

Section 6.1.1
   Need to clarify the canonical name - I presume there should be "one and 
only one", not "one or more" canonical names. Currently the MIT schema allows 
for the latter case, which is nonsensical to me. But if that's the desired 
behavior, please state explicitly state "one or more" here.

Section 5
   I feel that some mention should be made in this document referring to 
existing LDAP Password Policy implementations. E.g. "This model describes a 
number of elements related to password policy management. Not all of the 
elements in this model are unique to Kerberos; an LDAP implementation of this 
model should incorporate existing LDAP schema where functional overlap exists, 
rather than defining additional Kerberos-specific elements."

6.1.1.5, 6.1.1.6
   For auditing purposes, I think that these should be consolidated into a 
single multi-valued "principalFailedAuthentications" attribute that records 
the timestamps of each failure.

Section 6.4
   There's no discussion of policy related to ticket flags. This seems to be a 
pretty fundamental concept in KDC operation, so it's conspicuous in its absence.

A model attribute for the KDC realm name(s) would also seem to be appropriate, 
since the realm is also essential for KDC operation.

> 	Cheers Leif
>
>
> ------------------------------------------------------------------------
>

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg