Subject: Re: [Ietf-krb-wg] LDAP schema for kdc

From: Howard Chu <[email-masked]>
Date: Fri, 14 Aug 2009 14:12:23 -0700

Howard Chu wrote:
> General Commentary
>
> A significant portion of the model is concerned with password policies. Many
> of the same issues are being faced in LDAP and it would make sense to
> coordinate the effort there.

...

> Most of the MIT password policy attributes are already provided in the LDAP
> Password Policy draft
>
> http://tools.ietf.org/draft/draft-behera-ldap-password-policy/draft-behera-ldap-password-policy-09.txt
>
> That draft is long expired, but it would be worthwhile to write a new draft
> adding missing items as identified here:

I've published a new revision of the LDAP password policy draft (rev 10).
https://datatracker.ietf.org/drafts/draft-behera-ldap-password-policy/

It incorporates pretty much all of the items I identified here.

> 	krbPwdMindiffChars

Leaving that for a pwdCheckRules attribute coming in the next ppolicy revision.

> 	krbLastSuccessfulAuth

pwdLastSuccess

> Also something should be done to harmonize failed login tracking; currently
> the MIT schema uses two different attributes krbLastFailedAuth and
> krbLoginFailedCount while LDAP ppolicy uses a single pwdFailureTime attribute
> that records the timestamps of each failure. For auditing purposes, IMO the
> LDAP approach is more informative, but it may be overkill since login failures
> will usually also be logged elsewhere in a system.

I'll continue to proceed with the LDAP ppolicy spec here. If a KDC 
implementation insists on seeing LastFailedAuth and a FailedCount it can be 
trivially extracted from the LDAP attribute.

> Other elements mentioned in the data model that aren't present in LDAP
> Password Policy:
>
> 	keyNotUsedBefore

pwdStartTime

also added a corresponding pwdEndTime

> 	keyIsDisabled

Still no explicit attribute for this. I suggest setting pwdStartTime >= 
pwdEndTime.

> LDAP Password Policy attributes that do correspond to the Kerberos Information
> Model:
>
> Model Section		LDAP Password Policy
> 6.1.1.5,6.1.1.6		pwdFailureTime
> 6.1.1.8			pwdChangedTime
> 6.3.1.5			pwdMaxAge
> 6.4.2.1			pwdMinLength, pwdCheckQuality
> 6.4.2.2			pwdMinAge, pwdMustChange, pwdAllowUserChange,
> 			 pwdSafeModify
>
> MIT Kerberos schema elements that overlap LDAP Password Policy:
>
> MIT			LDAP
> krbMaxPwdLife		pwdMaxAge
> krbMinPwdLife		pwdMinAge
> krbPwdMinLength		pwdMinLength
> krbPwdHistoryLength	pwdInHistory
> krbPwdPolicyReference	pwdPolicySubentry
> krbPasswordExpiration	(redundant, use pwdChangedTime + pwdMaxAge)
> krbPwdHistory		pwdHistory
> krbLastPwdChange	pwdChangedTime
> krbLastFailedAuth	pwdFailureTime
> krbFailedLogincount	(pwdFailureTime)
>
> Sorry for the length of this email but hopefully it illuminates areas where
> further design work is needed. As I receive feedback from this post I will
> start drafting a proposal for a new LDAP Schema for Kerberos.

Aside from the definition of pwdCheckRules which still needs to be laid out, I 
believe the LDAP password policy specification fully supports all the password 
policy mechanisms of the current MIT KDC and the draft Kerberos KDC Model.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg