Subject: Re: Must a simple bind with DN and no pwd be treated as anonymous?

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 26 Aug 1999 16:21:06 +0200

Ludovic Poitou writes:

> This [binding with DN but no password] is described in the RFC2251
> page 22.  Zero length password means no authentication (anonymous
> mode).

I think the "(anonymous mode)" comment is misleading and should be
deleted from rfc2251.  It's nice to have e.g. WWW gateways bind with a
DN, even if unauthenticated, in order to identify themselves in the
LDAP/X.500 server logs.

-- 
Hallvard

---

From: Mark Smith <[email-masked]>
Date: Thu, 26 Aug 1999 10:48:13 -0400

> DN, even if unauthenticated, in order to identify themselves in the

The text in 2251 section 4.2.2 says:

   If no authentication is to be performed, then the simple
   authentication option MUST be chosen, and the password be of zero
   length.  (This is often done by LDAPv2 clients.)  Typically the DN is
   also of zero length.

This looks okay to me.  The word "anonymous" and variants does appear
elsewhere in 2251 though.  It might be more accurate to say
"unauthenticated" although the phrase "anonymous bind" is widely used to
refer to any simple bind that uses a zero-length password.

-- 
Mark Smith
iPlanet Directory Architect / Sun-Netscape Alliance
My words are my own, not my employer's.   Got LDAP?

---

From: Hallvard B Furuseth <[email-masked]>
Date: Thu, 26 Aug 1999 16:53:35 +0200

Mark Smith writes:
>    (...)

Duh.  Sorry.  I did check -- another problem I was working on.
And then I bugreported this instead of that other thing.
Hm.  Now what I was that bug I found...? :-)

-- 
Hallvard