Subject: [Ietf-krb-wg] OTP PIN Expired Error Code

From: <[email-masked]>
Date: Fri, 3 Sep 2010 08:11:03 -0400

One of Sam's recent review comments covered the the way that expired
PINs are handled.

    >> Section 2.3
    >> 
    >> We have not traditionally allowed a Kerberos KDC to change the
service
    >> principal requested by the client.  There is a mechanism to
return a
    >> realm referral error to send the client to a different realm, but
    >> generally in an as-req we don't change the service name.
    >> 
    >> I don't think adding this capability as part of a pre-auth method
is
    >> appropriate.  I think it would be reasonable to give the client
the
    >> principal it should request in an error, or to define a more
general
    >> mechanism for service name canonicalizationin FAST protected 
    >> as-reqs in
    >> another document and depend on that document.  My rationale 
    >> here is that
    >> we don't want to encourage pre-auth mechanisms making changes to
the
    >> base protocol because it makes them really hard to implement
using a
    >> provider/plugin interface.

I have therefore updated the text so that if PIN change is required, the
KDC returns a KDC_ERR_PIN_EXPIRED error containing a PA-OTP-PIN-CHANGE.

   Most OTP tokens involve the use of a PIN in the generation of the OTP
   value.  This PIN value will be combined with the value generated by
   the token to produce the final OTP value that will be used in this
   protocol.

   If, following successful validation of a PA-OTP-REQUEST in an AS-REQ,
   the KDC determines that the user's PIN has expired and needs to
   change then it SHOULD respond KRB-ERROR of type KDC_ERR_PIN_EXPIRED.
   It MAY include formatting information on the PIN in a PA-OTP-PIN-
   CHANGE (see Section 4.3) encrypted within the armored data of the PA-
   FX-FAST-REPLY PA-DATA element.

             KDC_ERR_PIN_EXPIRED           <TBD>

   If the PIN change is to be handled by a PIN-change service then it is
   assumed that authentication to that service will succeed if the PIN
   has expired as described above.

   If the user's PIN has not expired but has been changed then the KDC
   MAY return the new value to the client in a PA-OTP-PIN-CHANGE
   encrypted within the armored data of the PA-FX-FAST-REPLY PA-DATA
   element of the AS-REP.  Similarly, if PIN change is not required then
   the KDC MAY return a PA-OTP-PIN-CHANGE to inform the client of the
   current PIN's expiration time.

How do I get this new error code assigned?

--Gareth

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg