Subject: Re: key_exp vs. last_req

From: Assar Westerlund <[email-masked]>
Date: 11 May 2001 23:36:22 +0200

Ken Hornstein <[email-masked]> writes:
> >Is LRQ_PW_EXPTIME generally supported? By MIT KDCs? Heimdal? MS AD?
> 
> I can't speak for MS AD's.  I think Heimdal supports it, but I'd have to
> go check.

Yes, the Heimdal KDC generates it and the client will print it.

Furthermore, as I remember it, Ken specified:

lr-type
6               password expiration
7               account  expiration

and it seems 7 got dropped since it's not in
draft-ietf-cat-kerberos-revisions-08.txt.  Cliff: can you add it?

> Here's my concerns:
> 
> - We have different implementations, TODAY, that return different values for
>   this field.
> - The specification is unclear on the interpretation of this field.
> - The discussion we had on this topic ... TWO YEARS AGO ... in my mind
>   already resolved this issue.

I agree with Ken.  Since key_expiration is min(account_expiration,
password_expiration) or just unclear, let's forget about it and use
the defined lr-type(s).  If your implementation doesn't handle them
properly, it should take you less time to add that code than to read
this thread.

/assar

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 11 May 2001 17:48:59 -0400

Fine. When I get around to it I'll make sure my local MIT krb5 source
has support for this and I'll contribute the necessary patches, if any.

Nico

--