Release Meeting Minutes/2012-04-03
From K5Wiki
Will Fiveash, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu
IETF
- Tom
- IANA guidelines proposal from Sam?
- Greg
- Looks reasonable to me.
- Tom
- GSS extensions for cred stuff?
- Greg
- Might nto want to expose directly...?
- Simo
- Would expect admin to do it.
- Tom
- Note SAP admins explicitly config OIDs, mech shlib paths... URN content is not a cred itself.
- Simo
- Name only.
- Greg
- Proxy will know which cred by which client is talking to it.
- Simo
- Mechglue is minimally more intelligent than now. Fallback. Proxy server can tell mechglue to go direct.
- Simo
- Possible RFC for proxy protocol. Also implementation information. GSS-agent -- like ssh-agent, so maybe indirectly over the net.
Multi-master fallback
- Will
- ZFS storage appliance. AD multi-master race condition joining, creating service principal.
- Simo
- Can't do DNS alone. CLDAP, etc.
- Will
- MIT Kerberos. 2 KDCs. Multiple KDCs, admin servers in kdc.conf. Orders opposite. kinit -- principal not found. Should it try harder?
- Tom
- admin_server different from master. Are multiple masters tested?
- Simo
- Some enterprises have thousands of masters. Try to stick to a server. Locate plugin to stick to it. Consistency is important.
- Greg
- (to Simo) init_creds_step. sssd could do this instead of locate plugin.
- Simo
- Want all apps to stick to one KDC. AD does round robin. (same SRV priority)
- Tom
- Trying harder can lead to long timeouts.
