On Fri, 18 Jun 2010 16:18:05 +0400
Eugene Indenbom <eindenbom(a)gmail.com> wrote:
I hope that 389-ds team would support dropping expired GSSAPI
connection BEFORE changes to MIT Kerberos implementation become
widely available. Otherwise it will create a substantial hole in DS
security.
There is really no hole, it would be identical to password
authentication over a SSL channel.
Simo.
--
Simo Sorce * Red Hat, Inc * New York