Release Meeting Minutes/2015-03-10
Rob Campanella, Thomas Hardjono, Greg Hudson, Ben Kaduk, Nathaniel McCallum, Simo Sorce, Zhanna Tsitkov, Nico Williams, Tom Yu
Larger key versions
- kvno -- thought it would be simple, but turned out harder. 8-bit in keytab and kadm5 protocol, but 16-bit in KDB. kvno 0 is a special case in the DBE stuff, and ASN.1 encoders omit it.
- Your proposal seems OK. Please record keyset creation time.
Some discussion; such metadata are already being considered for some KDB data model renormalization.
Solaris 10 segfault
When explicit normal salt is sent to a Solaris 10 client in PA-ETYPE-INFO2, the client can segfault.
- Introduced in 1.7 but not effective until 1.11, due to some code masking the change.
- In the Luke Howard implementation, creds get stored to memory ccache. Made change to use default cache. Heimdal matches MIT.
Nico explains about how Solaris had the same semantic as Luke originally implemented; existing MIT and Heimdal behavior is incompatible. Discussion about what constitutes a reasonable side effect in GSSAPI.
Nico wants acq_cred_with_password to have the same behavior as with delegated creds.
- Please give feedback on the KDC service discovery draft in KITTEN.