Projects/Lockout - Revision history

Ghudson: /* Design */

2010-11-17T15:16:52Z

‎Design

2010-02-16T04:10:26Z

2009-11-20T17:41:21Z

2009-10-07T22:03:33Z

note approval

2009-10-02T13:52:05Z

‎After authentication

2009-10-02T13:51:48Z

‎After authentication

2009-09-21T15:49:09Z

‎Approvals

2009-09-21T15:48:13Z

2009-09-15T17:24:35Z

2009-09-15T06:29:45Z

‎Before authentication

← Older revision		Revision as of 15:16, 17 November 2010
Line 25:		Line 25:

	Only the latter is actually a new attribute. These four attributes are non-replicated: that is, each KDC has its own set of values. The lockout time is stored in TL data; all other attributes reuse existing fields in the principal entry. (However, the lockout time is surfaced as an explicit attribute at the kadm5 layer.)		Only the latter is actually a new attribute. These four attributes are non-replicated: that is, each KDC has its own set of values. The lockout time is stored in TL data; all other attributes reuse existing fields in the principal entry. (However, the lockout time is surfaced as an explicit attribute at the kadm5 layer.)
		+
		+	UPDATE: The lockout time attribute was removed from the implementation before it was merged to the trunk, and computed dynamically from the other principal fields and the policy fields.

	====Mapping to LDAP password policy draft====		====Mapping to LDAP password policy draft====

← Older revision		Revision as of 04:10, 16 February 2010
Line 1:		Line 1:
−	{{project-~~completed~~}}	+	{{project-rel\|1.8}}

−	<includeonly>[[Category: early stage projects]]</includeonly>
	==Background==		==Background==

← Older revision		Revision as of 17:41, 20 November 2009
Line 1:		Line 1:
−	{{project-~~approved~~}}	+	{{project-completed}}

	<includeonly>[[Category: early stage projects]]</includeonly>		<includeonly>[[Category: early stage projects]]</includeonly>

← Older revision		Revision as of 22:03, 7 October 2009
Line 1:		Line 1:
−	{{project-~~review\|2009-09-18~~}}	+	{{project-approved}}

	<includeonly>[[Category: early stage projects]]</includeonly>		<includeonly>[[Category: early stage projects]]</includeonly>

@@ Line 89: / Line 89: @@
+    {
         /* automatically unlock account if required */
-        entry.locked_time = 0;
+        entry.locked_time ::= 0
+    }

@@ Line 86: / Line 86: @@
 else if ( preauth_failure )
+{
     if (policy.failcnt_interval != 0 &&
         now > entry.last_failed + policy.failcnt_interval)
+    {
-        /* automatically unlock account after failcnt_interval */
+        /* automatically reset fail_auth_count after failcnt_interval */
         entry.fail_auth_count ::= 0
+    }
     entry.last_failed ::= now
     entry.fail_auth_count ::= entry.fail_auth_count + 1
     if (policy.max_fail != 0 &&
         entry.fail_auth_count >= policy.max_fail)

← Older revision		Revision as of 15:49, 21 September 2009
Line 236:		Line 236:

	===Approvals===		===Approvals===
		+	[[User:Sbuckley\|Steve]] 15:49, 21 September 2009 (UTC)

	===Discussion===		===Discussion===

← Older revision		Revision as of 15:48, 21 September 2009
Line 227:		Line 227:
	* v3 kpropd with v2 kadmind		* v3 kpropd with v2 kadmind
	* v3 kadmin with v2 kadmind		* v3 kadmin with v2 kadmind
		+	==Review==
		+
		+	This section documents the review of the project according to [[Project policy]].
		+	It is divided into multiple sections. First, approvals should be listed. To list an approval type
		+	:<nowiki>#~~~~</nowiki>
		+	on its own line.
		+	The next section is for summarizing discussion, which should take place on krbdev@mit.edu. Provide links to the archive at http://mailman.mit.edu/pipermail/krbdev/ if appropriate. Blocking objections can be noted with <nowiki>{{project-block}}</nowiki>.
		+
		+	===Approvals===
		+
		+	===Discussion===

← Older revision		Revision as of 17:24, 15 September 2009
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2009-09-18}}

	<includeonly>[[Category: early stage projects]]</includeonly>		<includeonly>[[Category: early stage projects]]</includeonly>

@@ Line 69: / Line 69: @@
 <pre>
 if ( entry.locked_time != 0 &&
-      policy.lockout_duration != 0 &&
+      ( policy.lockout_duration == 0 ||
-      now < entry.locked_time + policy.lockout_duration)
+        now < entry.locked_time + policy.lockout_duration ) )
     result ::= CLIENT_REVOKED
 </pre>