Subject: Re: comments on draft-zeilenga-ldap-authpassword-04.txt

From: "Timothy Hahn" <[email-masked]>
Date: Thu, 25 Jan 2001 16:43:21 -0500

Kurt,

Sounds good.

Thanks,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

To:     Timothy Hahn/Endicott/IBM@IBMUS
cc:     [email-masked] 
Subject:        Re: comments on draft-zeilenga-ldap-authpassword-04.txt

At 02:24 PM 1/25/01 -0500, Timothy Hahn wrote:
>Section 4.1, ABNF for authPasswordSyntax

seems reasonable.

>Section 4.4
>It would be nice to have a description for the attribute type.

seems reasonable.

>Also, in paragraph 3, explaining why no built-in matching rule is defined 
for the attribute type.

I can add one which has an assertion syntax of authPasswordSyntax.

>With this said, what is the intent then of defining the 
"authPasswordMatch" matching rule?

To allow a client to assert that a password, not an authPasswordSyntax
value, matches.

>Requiring the use of extensible match in order to use the matching rule 
seems harder than is necessary.

The authPasswordMatch as the EQUALITY matching rule would only
allow one scheme per password.

>Why is it desireable to dis-allow modification of individual values 
(assuming that the underlying transport service guarantees 
confidentiality).

I'll remove this restriction and add an appropriate equality matching
rule.