Subject: INITIAL flag and same-realm checks in set-passwd-00

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Jul 2003 10:12:46 -0700

draft-ietf-krb-wg-kerberos-set-passwd-00.txt allows the server to return
an error to the client indicating that the client should have used an
initial ticket for the given request.

A similar error code could be added to indicate that the client
principal's realm must be the same as the realm of the request's target
principal.

Then all text in draft-ietf-krb-wg-kerberos-set-passwd-00.txt about when
INITIAL tickets are needed and when a client principal's realm must
match that of the principal being modified can be removed altogether and
replaced with text explaining the server's ability to demand
initial/same-realm tickets for specific requests.

Cheers,

Nico
--

---

From: "Joel N. Weber II" <[email-masked]>
Date: Tue, 15 Jul 2003 14:12:32 -0400

While there certainly should be an error code to say that INITIAL
tickets were required and weren't presented, it seems very inefficient
to me in terms of round trips if a client actually reacts to such an
error by going back and getting a new set of service tickets and then
trying the password change protocol again.  It also adds complexity to
the implementation.  (Of course, if we specify things that way, a
client can just always get INITIAL tickets if it doesn't want that
complexity.)  It also adds the possibility that a future implmentation
will behave in a standards-compliant way that no existing
implementation had ever been tested against.

I don't see any benefits you get from being vague about what is to be
accepted by the server.

This is why I think we should be very explicit about the cases in
which non-INITIAL tickets are accepted, and describe them with MUST
rather than SHOULD or MAY.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Jul 2003 11:23:33 -0700

> implementation had ever been tested against.

The replacement text could certainly use SHOULD/MAY to describe
preferred behaviour but leave the ultimate policy to the server.
Initial tickets MUST be acceptable.

And the text could say that clients SHOULD expect that initial tickets
will be required.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 15 Jul 2003 11:46:46 -0700

Proposed rule:

   When a client principal is trying to change its own password/keys
   then it SHOULD expect that an initial ticket will be required and the
   server SHOULD require the use of an initial ticket.  For all other
   cases a client MAY expect non-initial tickets to be accepted and the
   server MAY require that the client use an initial ticket.

   The server MUST always accept an initial ticket where it would accept
   a non-initial ticket for the same client principal.

Similarly with realm matching.

Cheers,

Nico
--