Subject: Re: Must a simple bind with DN and no pwd be treated as anonymous?

From: "Roger Harrison" <[email-masked]>
Date: Thu, 26 Aug 1999 11:41:19 -0600

Then how can the client tell the difference between "authentication by assertion" and authentication using credentials?  This seems to be the very problem that the Authentication Response Control was designed to solve, i.e. with what identity is the client currently bound?

Roger

------------------------------------------------------
Roger G. Harrison
Novell, Inc.
[email-masked]

>>> "RL 'Bob' Morgan" <[email-masked]> 08/26/99 11:24AM >>>

> So, if I were going to implement the Authentication Response Control,
> and the server gets a bind with a valid DN and an empty password, what
> does it send back as the authDN in the response control (empty or
> original DN)? Or does it not send a response control at all, since no
> 'authentication' happened?

I think that it is legitimate for an implementation to support
"authentication by assertion", ie without a password or other credential
(since Hallvard said he thought it was useful for logging purposes).
Presumably it would be wise for a deployment using this to ensure that the
authentication identity is functionally equivalent to anonymous.  In this
case the server should, I think, send back the asserted DN in the
Authencation Response if in fact the server is using that as the
authorization identity.  If the server instead makes this an anonymous
connection, then it should respond saying this.  The Authentication
Response Control draft needs to say explicitly that the empty string is
returned when the connection is anonymous.

 - RL "Bob"

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Thu, 26 Aug 1999 18:07:53 +0000 ( )

> Then how can the client tell the difference between "authentication by
> assertion" and authentication using credentials?  This seems to be the
> very problem that the Authentication Response Control was designed to
> solve, i.e. with what identity is the client currently bound?

If the client asserts a DN in a simple bind and supplies no password, then
(1) its assertion is accepted as such, or (2) it is bound anonymously, or
(3) it gets an authentication failure with a inappropriateAuthentication
response code.  You're exactly right that the availability of the
Authentication Response Control would allow the client to distinguish
between cases (1) and (2).  Again, any sensible deployment would not give
any privileges to an authorization identity that could be bound-to without
supplying any credentials.

 - RL "Bob"