Subject: ACL draft: specify credentials

From: Rob Byrne - Sun Microsystems <[email-masked]>
Date: Thu, 28 Oct 1999 11:45:49 +0200

Hi Debbie,

A couple of things  on the "specify credentials" control.

1. There is (was ?) a draft from Rob Weltman for what he calls a "proxy
control" (draft-weltman-ldapv3-proxy-02.txt).  There seems to be some
overlap here.

2. How will the  access control model determine whether a user has the
right to proxy or not ie. use the "specify credentials control" ?

Rob.
--iPlanet Directory Group

---

From: Ellen Stokes <[email-masked]>
Date: Fri, 29 Oct 1999 13:28:46 -0500

The 2 drafts are similar but different.  The Weltman draft
specifies the proxy as a LDAPDN.  The access control model draft
talks about the ability to send only the credential, e.g. privilege
certificate, not the ability to say use this other DN.  What the
server does with credential (e.g. trust it, validate it, reject it)
is server defined (there's a section in the model that addresses
this point.

The Weltman draft is currently an individual submission.  So the
question is should we combine the 2 drafts, should we remove the
specify credentials - perhaps moving it to the Weltman draft, or
something else or some conbination?

Thoughts?

Ellen