Subject: context expiration and import_context()

From: Martin Rex <[email-masked]>
Date: Thu, 26 Feb 1998 17:50:19 +0100 (MET)

I'm still looking for a modification of the required semantics
of gss_import_sec_context() regarding security context expiration.

This only affects mechanisms like Kerberos that implement (mandatory)
security context expiration.  Currently the description lists
GSS_S_CONTEXT_EXPIRED as an allowable major status code.  I'd like
to see this major status code removed from gss_import_sec_context()
for similar reason(s) that I didn't want it from gss_inquire_context():
it severely complicates security context refresh at the application
level.

When gss_import_sec_context() encounters an expired security context,
it should still create a context handle that can be passed to
gss_inquire_context() for examination of peers and attributes,
even though the context may no longer be valid for message protection
and unprotection calls.

The issue with gss_export_sec_context() is different -- although
personally, I would really like to see the possibility to transfer
expired security as well, so that the context refresh can be done in
a different process.  It is not an issue for our application, but
it may be for others.  For a reliable security context refresh,
one will have to check each time before *protecting* a message if
there is enough context lifetime left so that the receiver will
be able to successfully unprotect it,  and attempt a security
context refresh if there's less than 5-10 minutes left or the
security context is already expired.

-Martin

---

From: "Linn, John" <[email-masked]>
Date: Wed, 11 Mar 1998 07:57:27 -0500

[I sent this to the list yesterday but it may not have made it outbound
from my local mail system and I haven't seen a return copy through the
list, so I'm re-Txing.  Apologies if this is a duplicate for anyone.]

> ----------
> From: 	Linn, John
> Sent: 	Tuesday, March 10, 1998 9:36 AM
> To: 	[email-masked]; [email-masked]'
> Subject: 	RE: context expiration and import_context()
> 
> I think this argument seems reasonable, and propose to drop
> GSS_S_CONTEXT_EXPIRED as a return value from gss_import_sec_context()
> as requested.  Objections or further discussion, anyone?
> 
> --jl
> 
> ----------
> From: 	Martin Rex[SMTP:[email-masked]]
> Reply To: 	[email-masked]
> Sent: 	Thursday, February 26, 1998 11:50 AM
> To: 	[email-masked]
> Subject: 	context expiration and import_context()
>