Subject: RE: "LDAP exchange" (was: Misuse of the term "association" in [Protocol])

From: "Jim Sermersheim" <[email-masked]>
Date: Mon, 04 Oct 2004 19:59:11 -0600

The current definition of 'association' refers to the authN and authZ
state as it applies to the <whatever term you want which describes the
exchange of LDAP PDUs>. If we use 'association' for that, then do we
need a new term for the old association definition?

Maybe we need to agree on the things that need defining, then define
them, then name them. Can we start with the image from Section 5? It
shows 4 layers, from bottom to top:

Layer 1 (currently connection): This is the transport layer which
carries all data between protocol peers. For example: TCP.

Layer 2 (currently TLS layer): I think the current definition is not
contentious

Layer 3 (currently SASL layer):  I think the current definition is not
contentious

Layer 4 (currently LDAP exchange): This represents the application
layer where LDAP PDUs are exchanged (sent and received) between protocol
peers. Is this definition non-descriptive? Does it not make sense? Is it
just the name that sucks? Maybe we should have called it 'LDAP PDU
layer"

Then there is (or at least there was) the thought that we need to
provide a term which describes the association of the authN and authZ
state as it relates to Layer 4. Kurt's suggestion is that we don't need
to define (nor name) this. But that we instead update the doc in the
places he described. I agree with most of the changes, but the change to
Section 6 makes me feel like the term was useful, and we're rewording
just so we can drop the use of the term.

If we decide to drop the term 'association' as Kurt suggested, do we
want to re-adopt it as the term to describe Layer 4 (I think this is
what Ron is asking for)?

Jim

>>> "Ramsay, Ron" <[email-masked]> 10/4/04 7:07:31 PM >>>
Hi Hallvard,

I had a look in *protocol*26.txt for a definition of "LDAP exchange"
and got nothing! Here are some quotes:

"The term "connection" refers to the underlying transport service used

   to carry the protocol exchange."

- This is the first use of "exchange" (apart from the TOC) and is
clearly not a definition.

"The term "LDAP exchange" refers to application layer where LDAP PDUs 
   are exchanged between protocol peers."

- I wouldn't call this a definition either. a) How can an "exchange" be
a layer? b) It "refers" to an application layer, but what is it?

"The term "SASL layer" refers to a layer inserted between the 
   connection and the LDAP exchange that utilizes Simple Authentication

   and Security Layer ([SASL]) to protect the exchange of LDAP PDUs."

- This use of exchange is more normal - peers simply exchanging PDUs,
no semantics implied.

So much for "exchange".

Now, tell me, what is your objection to "association". Or, to be more
specific, what sentence or paragraph in protocol-26 do you think
requires a term like (ugh) "exchange"?

Ron

PS Some comments inline

-----Original Message-----
From: Hallvard B Furuseth [mailto:[email-masked]] 
Sent: Monday, 4 October 2004 22:57
To: Ramsay, Ron
Cc: [email-masked] 
Subject: "LDAP exchange" (was: Misuse of the term "association" in
[Protocol])

Ramsay, Ron writes:
> I note that you are not listening to me, and I guess that it OK. But
> this problem will not go away until you drop this strange "LDAP
> exchange" thing. It DOES NOT, at least in English, mean the ongoing
> exchange of protocol data.

Nor is it defined that way in [Protocol].  Did you see my message
  http://www.openldap.org/lists/ietf-ldapbis/200410/msg00002.html 
?

<RR> Yes. I don't think the word "exchange" can be used in this
context. "Stream" is certainly better.

> The only chance for sanity here is to keep "association" and drop
> "exchange".

That would be wrong, since "association" is defined as something
different.  We could rename the term "LDAP exchange" to something else
(which would get the current definition of "LDAP exchange") after
making
Kurt's changes.  If you wish to suggest a better term, read this
thread
first:

  http://www.openldap.org/lists/ietf-ldapbis/200404/msg00023.html 

<RR> This seems to be talking about "connections"?

Personally I prefer several other terms over "LDAP exchange", but I
don't feel strongly about it.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 04 Oct 2004 20:35:47 -0700

At 06:59 PM 10/4/2004, Jim Sermersheim wrote:
>them, then name them.

Well first, are we merely defining terms which refer
to protocol layers or defining terms which refer to
service at that layer.  If it was for the former, we'd
be using 'transport layer' not 'connection'.  I think
its clear from the usage, that the terms refer both
the layer and service at that layer.  I'd argue more
of the latter than the former.

>state as it relates to Layer 4.

>Kurt's suggestion is that we don't need to define (nor name) this.

My suggestion is primarily aimed at leaving the discussion
of authentication, authorization, and security associations
(regardless of layers involved) to [AuthMeth].

>But that we instead update the doc in the

I generalized the security consideration so that it accounted
for other factors, e.g., factors which are not tied to the
'association' (whatever that means).

>want to re-adopt it as the term to describe Layer 4 (I think this is

First, I don't think Ron is necessarily asking for that.
He seems to be saying 'LDAP association' have a lifespan
not longer than the next Bind operation.  However, service
at the layer where LDAP PDUs are exchanged continues until
the connection closure.

Second, that would likely only create a need for a new term
in [authmeth] to refer to service at any and all layers,
and associated authentication, authorization, security,
and other factors.

Kurt

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 5 Oct 2004 18:08:00 +0200

> just so we can drop the use of the term.

My vote is to drop "association".  It doesn't seem very useful to define
a term which is only needed once, and apparently this is the only place
in [Protocol] which does need it.  I do like the current wording better
than Kurt's, but I also dislike to require readers to remember more
definitions than necessary.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 05 Oct 2004 09:42:26 -0700

At 09:08 AM 10/5/2004, Hallvard B Furuseth wrote:
>in [Protocol] which does need it.

One of my concerns is that, in reviewing [authmeth], we may
find that definition and use of "association" is poor.  (For
instance, we may find the use of "association' is inconsistent
with RFC 2828,2829,2830 and decide not to stick with the
current [authmeth] definition and usage.)   If so, I want to
be able to update [authmeth] without having to go back and
muck with [Protocol].

>I do like the current wording better

Here's a slightly reworded Section 6 offering.  Note that
I am trying to accomplish two things with this rewording.
1) avoid the term "association" in [protocol]
2) generalize the security consideration.

  Server implementors should plan for the possibility of that
  information (e.g., credentials) used to establish security
  factors (e.g., authorization identities) and/or policies
  (e.g., access controls) may change (due to protocol or
  external events) during the course of the LDAP exchange,
  and even during the performance of a particular operation,
  and should take steps to avoid insecure side effects of
  these changes.  The ways in which these issues are addressed
  are application and/or implementation specific.