Subject: [Ietf-krb-wg] WG Consensus: draft-ietf-krb-wg-kdc-model and atomicity

From: Sam Hartman <[email-masked]>
Date: Thu, 05 Jul 2012 16:07:17 -0400

Hi. I'm giving input as WG chair here because there was a WG discussion
and it's chairs' job to judge consensus here.
However, that discussion took place in the context of an IETF LC, and
that's Stephen's judgment call, so direction on what to do for the
document should come from him.

I believe that we have a very rough consensus within the Kerberos
working group at least to remove sections 4.1.1.5-7 and to make no other
changes with regard to issues surrounding lock out.  My rationale is
that no one objected to this change/said they could not deal with it. In
addition, no one indicated there was a nother option that they believed
could gain rough consensus.

I too believe that there was no other option likely to gain rough
consensus. Based on the discussion the question in my mind was wether we
had consensus to move forward at all. Since no one objected to moving
forward given an opportunity to do so, I believe we have that rough
consensus.

--Sam
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 5 Jul 2012 22:00:04 +0100

I'm fine with that. I don't recall any contradictory comments from folks not involved in the wg on this topic,

Cheers,
S

---

From: Leif Johansson <[email-masked]>
Date: Fri, 06 Jul 2012 01:02:50 +0200

On 07/05/2012 11:00 PM, Stephen Farrell wrote:
> I'm fine with that. I don't recall any contradictory comments from
> folks not involved in the wg on this topic,
> 

Excellent. I'll issue a new version with 4.1.1.5-7 removed and no
other changes.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 06 Jul 2012 15:49:42 -0400

On Fri, 2012-07-06 at 01:02 +0200, Leif Johansson wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 

Please also review Alexey's comments, and at least deal with the missing
references, which should be noncontroversial.

-- Jeff

---

From: Leif Johansson <[email-masked]>
Date: Sat, 07 Jul 2012 00:20:30 +0200

On 07/06/2012 09:49 PM, Jeffrey Hutzelman wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>> 
>>> I'm fine with that. I don't recall any contradictory comments
>>> from folks not involved in the wg on this topic,
>>> 
>> 
>> 
>> Excellent. I'll issue a new version with 4.1.1.5-7 removed and
>> no other changes.
> 
> Please also review Alexey's comments, and at least deal with the
> missing references, which should be noncontroversial.
> 
> -- Jeff
> 
yep

---

From: Leif Johansson <[email-masked]>
Date: Mon, 30 Jul 2012 04:48:46 +0200

> missing references, which should be noncontroversial.

I just posted -12 with the agreed changes. This version can now
progress.

	Cheers Leif

---

From: Sam Hartman <[email-masked]>
Date: Tue, 31 Jul 2012 04:49:00 -0400

The current version of the draft allocates some OIDs for policies.
Unfortunately there's some complexity with the allocation and IANA came
back with questions.  Leif asked some folks including myself where to
get these OIDs form.  (The answer for Kerberos OIDs is currently Tom via
krb5-oid-registrar)

However, in looking into this, I had a question as an individual (chair
hat off).
Why do we have these OIDs registered here?
It seems like the OID should name a specific set of policy objects with
well defined semantics and encoding.
This draft doesn't get to that level of detail.
Wouldn't it be better to defer that to schema  and/or implementation
documents?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Tue, 31 Jul 2012 08:55:12 -0500

> Wouldn't it be better to defer that to schema  and/or implementation

Agreed: this document doesn't specify LDAP schema, therefore it
shouldn't allocate OIDs for LDAP schema.  Other metaschemas might not
require OIDs either, and anyways, it's really only LDAP that we need
OIDs for in the Internet standards context.

Nico
--

---

From: Leif Johansson <[email-masked]>
Date: Tue, 31 Jul 2012 18:39:53 +0200

On 07/31/2012 03:55 PM, Nico Williams wrote:
>> Why do we have these OIDs registered here? It seems like the OID
>> should name a specific set of policy objects with well defined
>> semantics and encoding. This draft doesn't get to that level of
>> detail. Wouldn't it be better to defer that to schema  and/or
>> implementation documents?
> 
> shouldn't allocate OIDs for LDAP schema.  Other metaschemas might
> not require OIDs either, and anyways, it's really only LDAP that we
> need OIDs for in the Internet standards context.
> 
> Nico --
> 

I would tend to agree - but note that the information model includes an
identifier as part of the attributes associated with a policy "object"
so as it stands now, a schema has to assign some form of identifier.

If we drop the SHOULD requirement on the specific OIDs we could perhaps
stick something like this in there before the list of standard policies:

"A policy is identified by a unique identifier. It is expected that
implementations of this specification assign globally unique identifiers
(eg an OID or URI) to the following standard policies in accordance with
best-practice for identifier-management for the schema-language used:"

	Cheers Leif

---

From: Sam Hartman <[email-masked]>
Date: Tue, 31 Jul 2012 13:10:46 -0400

I support Leif's proposed change.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Tue, 31 Jul 2012 19:13:09 +0200

> I support Leif's proposed change.

Also just to be clear, this implies changing the IANA considerations
section text to "no considerations".
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Tue, 31 Jul 2012 19:26:05 +0200

On 07/31/2012 06:39 PM, Leif Johansson wrote:
>>> Why do we have these OIDs registered here? It seems like the
>>> OID should name a specific set of policy objects with well
>>> defined semantics and encoding. This draft doesn't get to that
>>> level of detail. Wouldn't it be better to defer that to schema
>>> and/or implementation documents?
> 
>> shouldn't allocate OIDs for LDAP schema.  Other metaschemas
>> might not require OIDs either, and anyways, it's really only LDAP
>> that we need OIDs for in the Internet standards context.
> 
>> Nico --
> 
> 
> I would tend to agree - but note that the information model
> includes an identifier as part of the attributes associated with a
> policy "object" so as it stands now, a schema has to assign some
> form of identifier.
> 
> If we drop the SHOULD requirement on the specific OIDs we could
> perhaps stick something like this in there before the list of
> standard policies:
> 
> "A policy is identified by a unique identifier. It is expected
> that implementations of this specification assign globally unique
> identifiers (eg an OID or URI) to the following standard policies
> in accordance with best-practice for identifier-management for the
> schema-language used:"
> 
> Cheers Leif
> 

Actually it turns out to be even simpler. I propose to change

"The use of OIDs is RECOMMENDED for this purpose."

with

"Implementations of this specification are expected to assign globally
unique identifiers to the list of standard policy below in accordance
with best-practice for identifier-management for the schema-language
used."

and then drop all of the <TBD>.n and "zero out" the IANA considerations.

	Cheers Leif

---

From: Nico Williams <[email-masked]>
Date: Tue, 31 Jul 2012 12:45:12 -0500

I support this change.