From 249097c62414abc99256af9dc622c284745081e4 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 10 Nov 2020 16:02:30 -0500 Subject: [PATCH] Update kdcpolicy design doc for jitter implementation Signed-off-by: Robbie Harwood Reviewed-By: Rob Crittenden Reviewed-By: Alexander Bokovoy --- doc/designs/krb-ticket-policy.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/designs/krb-ticket-policy.md b/doc/designs/krb-ticket-policy.md index 2e2f16307..6e1d6db4c 100644 --- a/doc/designs/krb-ticket-policy.md +++ b/doc/designs/krb-ticket-policy.md @@ -91,8 +91,10 @@ where administrators can specify max renew and life for each supported auth indi ### Ticket lifetime jitter -Ticket lifetimes can be jittered so that renewals / re-issues do not overwhelm the KDC at a certain moment. -The feature is enabled automatically so that we can avoid triggering an LDAP query on every `AS_REQ` and `TGS_REQ`. +All TGT lifetimes are varied slightly to avoid overwhelming the KDC with +simultaneous renewal requests. Jitter will reduce lifetimes by up to one hour +from the configured maximum lifetime (per policy). Significantly shorter +requested lifetimes will be unaffected. ## Implementation