Subject: RE: comments on draft-ietf-cat-kerberos-set-passwd-02.txt

From: "Linn, John" <[email-masked]>
Date: Thu, 9 Mar 2000 11:29:08 -0500

David writes, excerpting: 

> 
> I'd be interested in seeing that message.  Is there a web archive of
> this list that is available?

The currently live archive of the CAT WG list can be found at the IETF
secretariat, in ftp://ftp.ietf.org/ietf-mail-archive/cat/.  It's subdivided
by months, and has been backfilled to the beginning of 1998.  Earlier
archive spools are available at ftp://bitsy.mit.edu/cat-ietf/archive. 

--jl
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: John Brezak <[email-masked]>
Date: Thu, 9 Mar 2000 09:56:45 -0800

Why invent another admin protocol for dealing with account admin? LDAP can
be used for this. There are already examples of this both commercially and
opensource (LDAP+Heimdal).

Given the wide availability of LDAP based account management tools, it would
seem that the most useful admin protocol would follow along the lines of
LDAP.

This missing part would be to define a LDAP schema definition that includes
the needed principal attributes for dealing with Kerberos.

The one problem with LDAP is that it isn't good for setting passwords due to
the general nature of the protocol with regard to encryption. This is a
reason for having a specific password management protocol. This would allow
an implementor to be able to use the strongest encryption available to
protect the user's passwords independant of what general encryption can be
used for general account management.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, March 09, 2000 1:23 AM
> To: Ken Raeburn
> Cc: [email-masked]
> Subject: Re: comments on draft-ietf-cat-kerberos-set-passwd-02.txt
> 
> 
> Ken Raeburn <[email-masked]> writes:
> 
> > This is why I'd be opposed to the set-passwd changes.  The
> > change-passwd spec as is fills a gap required by the basic Kerberos
> > protocol (the "must change password" response); it's not a remote
> > administration tool.
> 
> I agree.
> 
> Are you (as in someone at MIT) going to brush up the OV kadmin spec
> and submit it as a draft?
> 
> /Johan