Release Meeting Minutes/2010-11-23
From K5Wiki
Greg Hudson, Thomas Hardjono, Tom Yu, Zhanna Tsitkova, Simo Sorce, Sam Hartman
anon-pkinit issue.
- Greg
- start new conversation on krb-wg about authorization issue, e.g. whether KDC policy can restrict what tickets it issues -- already exists for things like requires_preauth
- Simo
- service can allow all principals, including cross-realm
- Greg
- add text excepting anonymous from standard ticket issuance/authorization model [ look whether anonymous creation of host principals really makes sense where a site tightly controls what principals exist because some services accept any authentication as authorization ]
- Greg
- new proposal: knob to allow local TGS only with anon client, to ease deployment of FAST
