Re: [kitten] [EXTERNAL] Re: Windows Intent to revive and implement IAKerb draft-ietf-kitten-iakerb-03

[Nico Williams <[e-mail]>]

To be specific, I think we ought to have at least:

 - a document on what self-service orchestration is, and example
   authorization policies one might want to use

   This might be an FYI.

   And maybe some protocols as well.

 - a protocol for fetching keytabs and/or rotating service keys

   This includes documenting the need for fetching keys that are needed
   to decrypt extant or soon-to-be-extant tickets when a service is
   clustered and the cluster membership is dynamic.  And how the set of
   kvnos needed depends on the ticket lifetimes and when the current
   keys were set.  And that older keys than that should not be returned.

   And so on.

   The point being that a protocol that merely sets new keys on a
   service principal is not enough.

   This is very relevant to the virtual service principal namespace
   feature in Heimdal (which really helps with operation by cutting out
   the need for synchronization).  This feature is really only worthy of
   an FYI unless we mean to also update the LDAP schema to know about
   it.

Heimdal has had a bunch of features that help with operation and
orchestration, with some being candidates for FYIs, some for BCPs, and
some for STDs.  There's no reason only Heimdal should have them.  I'd
welcome other implementors to adopt them.

Nico
--