Subject: RE: Login Failure and Sessions

From: "Liu, Hong" <[email-masked]>
Date: Mon, 5 Aug 2002 11:19:20 -0500

Scott,

I agree with Patrick that this is a server policy issue. The protocol should
not specify the exact value of N.

--Hong

-----Original Message-----
From: Patrick [mailto:[email-masked]]
Sent: Monday, August 05, 2002 10:55 AM
To: [email-masked]
Subject: Re: Login Failure and Sessions

On Mon, Aug 05, 2002 at 09:52:59AM -0400, Hollenbeck, Scott took time to
write:
> I'm working on putting a state diagram in the EPP draft per a last-call
> comment from our AD.  While working through this I came across something
> that we haven't captured in the documents: what should a server do in case
> of a login failure due to bogus credentials?
> 
> My preference would be for consistent behavior across all transports.  I
see
> a few options for dealing with login failures:

I think that this is a policy issue.
The protocol should only state that the server MAY close the
connection after login failure, so that the client knows he must deal
with this case.
Of course following commands (in such case as the one you describe
with an email containing login-commands-lougout) are not processed,
and discarded by the server.

Other than that, it should be up to each Registry to see if they
prefer to close the connection, limit the number of attempts or do
not limit anything.

Patrick.

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 5 Aug 2002 12:40:22 -0400

> not specify the exact value of N.

If so, then we have a protocol with a non-deterministic state diagram.  The
state of the server WRT to login failures ends up being
implementation-dependent, and I think this is going to get us in trouble
with the IESG *.

-Scott-

* I say this because I've been told by our AD that we need a state diagram
in the specs, and I can't draw such a diagram if I can't document how the
server behaves when it has to deal with a client authentication failure.
I'm open to suggestions as to how this kind of implementation choice might
be described in a state diagram...

---

From: "Liu, Hong" <[email-masked]>
Date: Mon, 5 Aug 2002 14:14:44 -0500

Scott,

I understand your concerns, but the retrial number N is really a
configuration parameter. It is not unusual to leave this type of parameters
for run-time configuration, take the windowing protocol as an example. The
size of the window is not fixed in the spec.

It may help, though, to give guidelines to selecting an appropriate value of
N in the spec.

--Hong

-----Original Message-----
From: Hollenbeck, Scott [mailto:[email-masked]]
Sent: Monday, August 05, 2002 12:40 PM
To: 'Liu, Hong'; [email-masked]
Subject: RE: Login Failure and Sessions

-Scott-