Subject: Re: ldap password policy approach

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 27 Oct 1999 20:21:59 -0600

Kurt,

If we open the discussion up to LDAP applications in general rather than talk specifically about authentication applications, I don't think an administrator can realistically enforce well behaved applications. Since LDAP is an open protocol, and surely there is/will be a wide array of applications that are LDAP enabled, how can an administrator prevent a 'naughty' LDAP application from being run at my desktop?

<The original discussion had to do with whether the server or the client should enforce password policy when modifying the password. You had suggested an enforcePasswordPolicy control to be used with the modify request>

Jim

>>> "Kurt D. Zeilenga" <[email-masked]> 10/23/99 11:38:06 AM >>>
At 02:20 PM 10/22/99 -0600, Jim Sermersheim wrote:
>>>> "Kurt D. Zeilenga" <[email-masked]> 10/22/99 1:22:33 PM >>>

> Who polices all the 3rd party authentication applications to
> make sure they're well behaved?

The administrator.  No approach which can stop a 3rd party
authentication application from circumventing the password
policy.  It's up to the administrator to choose well behaved
applications (and to define "well behaved").

----
Kurt D. Zeilenga		<[email-masked]>
Net Boolean Incorporated	<http://www.boolean.net/>

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 27 Oct 1999 22:13:01 -0700

>If we open the discussion up to LDAP applications in general rather than talk specifically about authentication applications, I don't think an administrator can realistically enforce well behaved ap…

This is the same problem as a 'naughy' whatever application.
Administrators should deal in the same manner as if the user
had used in any other unauthorized software.

3rd party authentication services are, if authorized, are
generally choosen (and policed) by the administrator.

Kurt

----