find inactive accounts

[Ken Raeburn]

On Jan 20, 2010, at 09:15, John Hascall wrote:
>   Ah yes, I'd forgotten that.
>   so:
>       1a) I would use an incremental propagation technique.

The current iprop mechanism relies on full propagation in cases where  
the slave has gotten too far behind.  It's automatic, too, so both  
modes need to support per-KDC info.  (And for all I know, maybe in the  
1.8 branch they do now.)

>   and
>       1b) I'd bug the Kerb team to fix this :)

Go for it, but note the signature below... :-)

-- 
Ken Raeburn / raeburn at mit.edu / no longer at MIT Kerberos Consortium