Subject: [Ietf-krb-wg] informational model: good since date

From: Sam Hartman <[email-masked]>
Date: Wed, 21 Oct 2009 17:34:20 -0400

The last thing we need at this point in the info model is more
attributes to add.  However I'll bring one up.

DCE had a concept of a good since date.  The idea is roughly that
tickets issued before the good since date are invalid.  You could
update your good since date to invalidate outstanding TGTs.

I may have brought this up in the past.
At this late point in the process I think we'd need to see significant support before adopting this.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 21 Oct 2009 16:38:02 -0500

> At this late point in the process I think we'd need to see significant support before adopting this.

I'm fine with adding such an attribute.

Nico
--

---

From: Howard Chu <[email-masked]>
Date: Fri, 23 Oct 2009 15:20:47 -0700

> At this late point in the process I think we'd need to see significant support before adopting this.

What is the practical difference between this and 6.1.1.2, principalNotUsedBefore?

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Sun, 25 Oct 2009 12:05:49 -0400

>>>>> "Howard" == Howard Chu <[email-masked]> writes:

    Howard> Sam Hartman wrote:
    >> DCE had a concept of a good since date.  The idea is roughly
    >> that tickets issued before the good since date are invalid.
    >> You could update your good since date to invalidate outstanding
    >> TGTs.
    >> 
    >> I may have brought this up in the past.  At this late point in
    >> the process I think we'd need to see significant support before
    >> adopting this.

    Howard> What is the practical difference between this and 6.1.1.2,
    Howard> principalNotUsedBefore?
1) I would not generally expect to give a user access to set 6.1.1.2 themselves.

2) I think it has a huge semantic difference.  For example I would not
expect to find any audited events caused by a subject whose not use
before date had not yet past.  I.E. I'd never expect 6.1.1.2 to go
back in time.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg