Subject: RE: "LDAP exchange" (was: Misuse of the term "association"in[Protocol])

From: "Jim Sermersheim" <[email-masked]>
Date: Tue, 26 Oct 2004 09:08:29 -0600

As this thread winds down, I have to say (as a side note) that I do like
RFC 1777's use of the term "session" over our term "association".
 
Just couldn't resist picking at the not-yet-healed scab.

>>> "Kurt D. Zeilenga" <[email-masked]> 10/26/04 1:08:09 AM >>>
Ron:
> So , please, chapter and verse!

Section 4.3. But, as discussed on this list before, clarification
of that section was needed to make it clear the purpose of the
Unbind operation is to gracefully terminate the connection and
everything it carries.

At 10:50 PM 10/25/2004, Jim Sermersheim wrote:

>[protocol] is more explicit than "may close the connection", and says
"The function of the Unbind Operation is to terminate an LDAP exchange
and close the connection". This does remove ambiguity and resolves some
interoperability issues (i.e. RFC 2251 failed to specify the AuthN state
of a protocol session post Unbind).

Correct. We could even be more precise in that the Unbind
request causes the termination of the LDAP exchange and the
graceful closure of the SASL layer, graceful closure of the
TLS layer, and graceful close of the connection.

>Ron, are you asserting that we should go back to RFC 2251 semantics,
>or RFC 1777 semantics.

This question is ambiguous as there is/was contention as to what
those semantics were. A better question would be:
If the Unbind operation is not disconnect operation, what is it?

>If we go back to RFC 2251 semantics (which are underspecified),

Again, ambiguous. Some would argue that [Protocol] and RFC 2251
are consistent here. That is, the function in both is to
gracefully terminate the connection (and everything it carries).

---

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 29 Oct 2004 20:37:39 +0200

> Just couldn't resist picking at the not-yet-healed scab.

Well, we killed "association".  But now that you mention it, I only find
a few "LDAP exchange"s that can't be replaced with "session"s.  Perhaps
we should s/LDAP exchange/LDAP PDU layer/ (why didn't I think of that
term before?) in the texts below, and s/(on the) LDAP exchange/(in the)
session/ elsewhere:

OTOH, one shouldn't pick on scabs:-)

> 2. Conventions 
>    The term "TLS layer" refers to a layer inserted between the 
>    connection and the LDAP exchange that utilizes Transport Layer 
>    Security ([TLS]) to protect the exchange of LDAP PDUs. 
>
>    The term "SASL layer" refers to a layer inserted between the 
>    connection and the LDAP exchange that utilizes Simple Authentication 
>    and Security Layer ([SASL]) to protect the exchange of LDAP PDUs. 

> 4.4. Unsolicited Notification 
> 
>    An unsolicited notification (...) is used to signal an extraordinary
>    condition in the server or in the LDAP exchange or connection between
>    the client and the server.

> 4.14.1. StartTLS Request 
> 
>    The client MUST NOT send any PDUs on this LDAP exchange following 
>    this request until it receives a StartTLS extended response and, in 
>    the case of a successful response, completes TLS negotiations. 

> 4.14.3.1. Graceful Removal 
>  
>    Either the client or server MAY remove the TLS layer and leave the 
>    LDAP exchange intact by sending and receiving a TLS closure alert. 
>
>    (...) If it wishes to leave the LDAP exchange intact, (...)
>    (...) choose to allow the LDAP exchange to remain intact (...)

> 5. Protocol Encoding, Connection, and Transfer 
>
> [The layer shown in the table.]

-- 
Hallvard