Subject: Re: Must a simple bind with DN and no pwd be treated as anonymous?

From: "Jim Sermersheim" <[email-masked]>
Date: Thu, 26 Aug 1999 10:28:15 -0600

>>> Mark Smith <[email-masked]> 8/26/99 8:48:33 AM >>>
>The text in 2251 section 4.2.2 says:

>   If no authentication is to be performed, then the simple
>   authentication option MUST be chosen, and the password be of zero
>   length.  (This is often done by LDAPv2 clients.)  Typically the DN is
>   also of zero length.

So, if I were going to implement the Authentication Response Control, and the server gets a bind with a valid DN and an empty password, what does it send back as the authDN in the response control (empty or original DN)? Or does it not send a response control at all, since no 'authentication' happened?

Jim

---

From: [email-masked] (Rob Weltman)
Date: Thu, 26 Aug 1999 09:40:53 -0700

> So, if I were going to implement the Authentication Response Control, and the server gets a bind with a valid DN and an empty password, what does it send back as the authDN in the response control…

  My choice would be to send back an empty DN. Don't want to trick the client into thinking that the server accepted the proposed authDN without a password. Do other v3 servers distinguish between "anonymous authentication" and "no authentication"?

Rob

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Thu, 26 Aug 1999 17:25:07 +0000 ( )

> So, if I were going to implement the Authentication Response Control,
> and the server gets a bind with a valid DN and an empty password, what
> does it send back as the authDN in the response control (empty or
> original DN)? Or does it not send a response control at all, since no
> 'authentication' happened?

I think that it is legitimate for an implementation to support
"authentication by assertion", ie without a password or other credential
(since Hallvard said he thought it was useful for logging purposes).
Presumably it would be wise for a deployment using this to ensure that the
authentication identity is functionally equivalent to anonymous.  In this
case the server should, I think, send back the asserted DN in the
Authencation Response if in fact the server is using that as the
authorization identity.  If the server instead makes this an anonymous
connection, then it should respond saying this.  The Authentication
Response Control draft needs to say explicitly that the empty string is
returned when the connection is anonymous.

 - RL "Bob"

---

From: [email-masked] (Rob Weltman)
Date: Thu, 26 Aug 1999 14:14:42 -0700

> returned when the connection is anonymous.

  I'll add that in the next revision of the draft.

Rob