Mailing-List: contact directory-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List"
 <directory-dev@incubator.apache.org>
Received-SPF: neutral (hermes.apache.org: local policy)
Message-ID: <41A3AB6E.3080501@apache.org>
Date: Tue, 23 Nov 2004 16:28:14 -0500
From: Enrique Rodriguez <erodriguez@apache.org>
User-Agent: Mozilla Thunderbird 0.9 (X11/20041103)
MIME-Version: 1.0
To: Apache Directory Developers List <directory-dev@incubator.apache.org>
Subject: Re: I'd like to start helping out here
References: <41A3997D.3050401@d-haven.org> <41A3A4A0.9080509@apache.org>
 <41A3A6EB.4070407@d-haven.org>
In-Reply-To: <41A3A6EB.4070407@d-haven.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Berin Loritsch wrote:
> Enrique Rodriguez wrote:
>> Berin Loritsch wrote:
>> Detection of both of these scenarios should be encapsulated in the 
>> Kerberos ProtocolProvider, but with denial performed as close to the 
>> wire as possible.
>>
>> Additionally, Kerberos admins should be able to clear denied Clients 
>> via management interface, so there should be a way to notify of a 
>> cleared address, too.  This usually happens due to misconfigured clients.
>>
> I personally would start with a windowed blackout time.

Sounds good.  I agree a windowed blackout time should be default.  The 
misconfiguration scenario I describe is a special case, when an admin 
setting up a client makes a mistake and it is specific to configuring 
Kerberos.  Waiting 20 minutes would be a huge inconvenience and 
restarting the services may not be acceptable.

-enrique