https://k5wiki.test.kerberos.org/wiki?action=history&feed=atom&title=Release_Meeting_Minutes%2F2012-04-03Release Meeting Minutes/2012-04-03 - Revision history2026-05-14T17:25:42ZRevision history for this page on the wikiMediaWiki 1.27.4https://k5wiki.test.kerberos.org/wiki?title=Release_Meeting_Minutes/2012-04-03&diff=4596&oldid=prevTomYu: New page: {{minutes|2012}} Will Fiveash, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu == IETF == ;Tom: IANA guidelines proposal from Sam? ;Greg: Looks reasonable to me. ;Tom:...2012-04-17T21:23:35Z<p>New page: {{minutes|2012}} Will Fiveash, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu == IETF == ;Tom: IANA guidelines proposal from Sam? ;Greg: Looks reasonable to me. ;Tom:...</p>
<p><b>New page</b></p><div>{{minutes|2012}}<br />
Will Fiveash, Thomas Hardjono, Greg Hudson, Simo Sorce, Zhanna Tsitkov, Tom Yu<br />
<br />
== IETF ==<br />
<br />
;Tom: IANA guidelines proposal from Sam?<br />
<br />
;Greg: Looks reasonable to me.<br />
<br />
;Tom: GSS extensions for cred stuff?<br />
<br />
;Greg: Might nto want to expose directly...?<br />
<br />
;Simo: ''Would'' expect admin to do it.<br />
<br />
;Tom: Note SAP admins explicitly config OIDs, mech shlib paths... URN content is not a cred itself.<br />
<br />
;Simo: Name only.<br />
<br />
;Greg: Proxy will know which cred by which client is talking to it.<br />
<br />
;Simo: Mechglue is minimally more intelligent than now. Fallback. Proxy server can tell mechglue to go direct.<br />
<br />
;Simo: Possible RFC for proxy protocol. Also implementation information. GSS-agent -- like ssh-agent, so maybe indirectly over the net.<br />
<br />
== Multi-master fallback ==<br />
<br />
;Will: ZFS storage appliance. AD multi-master race condition joining, creating service principal.<br />
<br />
;Simo: Can't do DNS alone. CLDAP, etc.<br />
<br />
;Will: MIT Kerberos. 2 KDCs. Multiple KDCs, admin servers in kdc.conf. Orders opposite. kinit -- principal not found. Should it try harder?<br />
<br />
;Tom: admin_server different from master. Are multiple masters tested?<br />
<br />
;Simo: Some enterprises have thousands of masters. Try to stick to a server. Locate plugin to stick to it. Consistency is important.<br />
<br />
;Greg: (to Simo) init_creds_step. sssd could do this instead of locate plugin.<br />
<br />
;Simo: Want all apps to stick to one KDC. AD does round robin. (same SRV priority)<br />
<br />
;Tom: Trying harder can lead to long timeouts.</div>TomYu