Release Meeting Minutes/2010-11-23

From K5Wiki
< Release Meeting Minutes
Revision as of 18:19, 3 January 2011 by TomYu (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Greg Hudson, Thomas Hardjono, Tom Yu, Zhanna Tsitkova, Simo Sorce, Sam Hartman

anon-pkinit issue.

start new conversation on krb-wg about authorization issue, e.g. whether KDC policy can restrict what tickets it issues -- already exists for things like requires_preauth
RFC 1510, RFC 4120 say to not use ticket issuance as authorization.
service can allow all principals, including cross-realm
add text excepting anonymous from standard ticket issuance/authorization model [ look whether anonymous creation of host principals really makes sense where a site tightly controls what principals exist because some services accept any authentication as authorization ]
new proposal: knob to allow local TGS only with anon client, to ease deployment of FAST