Subject: comments on draft-zeilenga-ldap-authpassword-04.txt

From: "Timothy Hahn" <[email-masked]>
Date: Thu, 25 Jan 2001 14:24:51 -0500

Greetings,

Section 4.1, ABNF for authPasswordSyntax

I think that the "[authInfo]" can safely be "authInfo" since the 
separators ($ signs) are not optional and the authInfo can be zero length 
based on the definition of schemeSpecificValue.

Section 4.4

It would be nice to have a description for the attribute type.

Also, in paragraph 3, explaining why no built-in matching rule is defined 
for the attribute type.  With this said, what is the intent then of 
defining the "authPasswordMatch" matching rule?  Requiring the use of 
extensible match in order to use the matching rule seems harder than is 
necessary.  Why is it desireable to dis-allow modification of individual 
values (assuming that the underlying transport service guarantees 
confidentiality).

Thanks,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 25 Jan 2001 13:35:18 -0800

>Section 4.1, ABNF for authPasswordSyntax 

seems reasonable.

>It would be nice to have a description for the attribute type. 

seems reasonable.

>Also, in paragraph 3, explaining why no built-in matching rule is defined for the attribute type.

I can add one which has an assertion syntax of authPasswordSyntax.

>With this said, what is the intent then of defining the "authPasswordMatch" matching rule?

To allow a client to assert that a password, not an authPasswordSyntax
value, matches.

>Requiring the use of extensible match in order to use the matching rule seems harder than is necessary.

The authPasswordMatch as the EQUALITY matching rule would only
allow one scheme per password.

>Why is it desireable to dis-allow modification of individual values (assuming that the underlying transport service guarantees confidentiality). 

I'll remove this restriction and add an appropriate equality matching
rule.