Subject: RE: Simple+TLS as mandatory-to-implement (RE: Issues with current authmeth draft.)

From: "Ramsay, Ron" <[email-masked]>
Date: Tue, 13 May 2003 14:38:33 +1000

I guess te time for history is now passed, btu I would like to note that the date on the RFC is May 2000 and that SASL profiling is a very recent occurrence. It wpuld be interesting to hear from, say, Paul Leech, what he thought he was arguing for, or even from the authors of the RFC.

I note that LDAPbis cannot change the LDAP specification, but do you see it as possible to change the mandatory-to-implement authentication method? I note that RFC 2829 is on the Standards Track.

Ron

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Tuesday, 13 May 2003 13:15
To: Ramsay, Ron
Cc: [email-masked]
Subject: Simple+TLS as mandatory-to-implement (RE: Issues with current
authmeth draft.)

At 07:25 PM 5/12/2003, Ramsay, Ron wrote:
>I don't believe you can mandate simple/TLS!

I certainly cannot mandate it.  But the IETF certainly can. 

>At the time RFC 2829 was debated, a large number on the WG wanted this. They did not get their way because of the complexity of the solution. It was argued that a password-based method would be better. I think they believed it would still be DN/password, though. 

I think clear from this discussion that some folks didn't
get what they thought they were getting.

If one takes the view that RFC 2829 intended DNs in DIGEST-MD5
user names, than RFC 2829 is serious broken.  DNs in DIGEST-MD5
is not workable.  So, it would be quite reasonable to open a
discussion on choosing a different mandatory-to-implement strong
authentication mechanism.

If one takes the view that RFC 2829 intended user name in
DIGEST-MD5 user names, then RFC 2829 just needs some clarification.
However, since significant specification and interoperability issues
exist with DIGEST-MD5, it would be reasonable here to open a
discussion on choosing a different mandatory-to-implement strong
authentication method.

At this point, I (as co-chair), consider the issue open.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 12 May 2003 22:41:47 -0700

At 09:38 PM 5/12/2003, Ramsay, Ron wrote:
>I note that LDAPbis cannot change the LDAP specification,

We certainly can change, within certain limits, the LDAP
technical specification.  See our charter.

>but do you see it as possible to change the mandatory-to-implement authentication method?

Yes.  Changing an elective feature to be mandatory-to-implement
is quite possible.  However, such changes should not be made lightly.

Kurt