Subject: Re: [Ietf-krb-wg] Referrals: follow-referrals FAST option

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 20 Dec 2011 20:08:45 -0500

Sorry; I was rather buried in work over the summer, when this exchange
originally happened, and this is one of a handful of threads that I'm
only now catching up on...

On Fri, 2011-06-10 at 16:13 -0400, Sam Hartman wrote:
> OK. I'd like to hear a call from the chairs (I'm a document editor for
> this document) on what to do here.
> We had consensus for the text when it was in the preauth framework, but
> we have a weak preference against now.

Looking at the history, this text was in preauth-framework since -03,
back in 2006.  It was still present in -12 of that document, which
passed working group last call.  When I did my review of the document,
post-WGLC, I found that this feature would require a normative reference
to referrals, which would delay publication of preauth-framework until
referrals was done.  At the time, Sam and I seem to have agreed to pull
the normative specification of the feature from preauth-framework and
move it to referrals, leaving only the reservation of the flag bit.  No
one else spoke up, and that change was made in -15, which was then sent
along to the IESG and went to IETF last call.

So now I'm in a quandary.  It seems pretty clear we had consensus to
include the feature when preauth-framework was submitted, based on some
three years, 12 versions, and a working group last call.  We discussed
moving it to referrals, and removed it from preauth-framework on that
basis.  But now referrals is in WGLC without that text.

So, I'd like to see opinions on whether we should include this text in
referrals, or drop the feature entirely.  Particularly, I'd like to see
enough opinions that I can reasonably determine what the consensus is,
if any, rather than having to guess.  If I have to guess, I don't know
what my guess will be, so please, speak up.

Just a reminder, referrals is in WGLC until January 6.

-- Jeff

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Tue, 20 Dec 2011 20:17:43 -0600

I have no interest in the kdc-follow-referrals option.  I would be
opposed to it if clients would end up depending on it, as the thought
of a client colluding with remote realms' KDCs to cause some KDC to
follow very long referrals chains, thus wasting significant KDC
resources.  Short of not having this feature at all I don't see how to
ensure that no clients ever come to depend on this functionality, thus
I am in fact opposed to it.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Wed, 21 Dec 2011 07:25:37 -0500

I'd kind of like to explore the follow-referrals technology, and I'd
like it if some day we perhaps had this option.
However, Greg's argument is compelling to me.
I don't think we should fold this into referrals.
There's a lot to say about DOS and other issues.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg