Subject: [Ietf-krb-wg] [Fwd: Re: Fwd: New Version Notification for draft-ietf-krb-wg-kdc-model-09]

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 30 Mar 2011 12:34:23 +0200

-------- Forwarded Message --------
From: Jeffrey Hutzelman <[email-masked]>
To: Leif Johansson <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Fwd: New Version Notification for
draft-ietf-krb-wg-kdc-model-09
Date: Wed, 30 Mar 2011 11:18:59 +0200

On Sat, 2010-11-13 at 09:43 +0100, Leif Johansson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> This includes all ID-nits and a few other things jhuts caught in final
> review. This should be ready to send to the IESG now.

This version still doesn't expand the term "KDC" where it is used in the
Abstract (which must stand alone, separate from the rest of the
document).  However, since I believe that to be the only outstanding
issue, we'll defer dealing with it until the document needs to be
revised anyway, or else fix it in editing.

I did have one outstanding question regarding section 4.4.1.1,
describing the policyIdentifier attribute:

- Section 6.4.1.1 (policyIdentifier): I'm confused.  Does this
  attribute name a specific policy, such as "passwords must be at
  least 8 characters long", or a class of policy such as password
  quality policies?  Does each different password quality policy in
  a KDB have a distinct policyIdentifier, or do they all use the
  same identifier?

This doesn't necessarily require a revision to the document, but I'd
appreciate a response to clarify this point.

-- Jeff

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Wed, 30 Mar 2011 18:50:16 +0200

> revised anyway, or else fix it in editing.

Agreed.

> appreciate a response to clarify this point.

The latter, i.e policyIdentifier refers to a specific policy and not
a class of policies.

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Wed, 30 Mar 2011 20:50:00 +0200

> I've now rediscovered the source of my confusion.  When I first started
> reading this section, I figured you'd have a bunch of policies in the
> database, each of which had a unique identifier and which described a
> particular restriction, such as "passwords must be at least 8 characters
> long" or "passwords must be at least 423 characters long".  But then I
> read section 4.4.2, which seems to say that policyIdentifier should
> always be <TBD>.1 for a password policy, indicating that this is in fact
> a policy type and not an identifier of a specific policy.
> 
> 
> So, I think we are going to need some kind of update to make this clear.
> Unfortunately, I still am not sure what it's supposed to mean.

Yes you are right. I must have been less than awake when I wrote that.
Clearly it is supposed to mean "class of policy".

	Cheers Leif