Subject: [ldapext] Returning the Password Policy Control

From: "Andrew Sciberras" <[email-masked]>
Date: Tue, 2 Sep 2003 10:44:59 +1000

Hi,

I believe that there may be some ambiguity in the password policy draft
(draft-behera-ldap-password-policy-06.txt) regarding the inclusion of a
PasswordPolicyResponse control in LDAP response messages.

When the text discusses how various operations should be processed (Section
6), it is very clear on what the passwordPolicyResponse control should
contain in each of the various erroneous and successful scenario's.
The text even goes to the extent of specifying that the control should be
returned with an empty SEQUENCE for various bind and compare cases.

I believe the ambiguity lies with other operations (ADD for example), where
the text does not specify whether a control should be returned if the
operation is completed successfully.
Typically I would assume that the absence of such text would mean that a
control should not be returned. However this seems to conflict with the
following description of the 'Response Control', which can be found in
section 5.2:
"  If the client has sent a passwordPolicyRequest control, the server
   sends this control with the following operation responses:
   bindResponse, modifyResponse, addResponse, compareResponse and
   possibly extendedResponse, to inform of various conditions....."

Although this sentence lacks any mandating words, such as MUST, I interpret
it to mean that the passwordPolicyResponse control should always be returned
for the previously mentioned operations, if a passwordPolicyRequest control
was supplied in the original LDAP request.

So, I my question is, when should a passwordPolicyResponse control be
returned?
Only when the text explicitly states that it should, or whenever a
passwordPolicyRequest control is included in an LDAPMessage?

I think that it is important to include the passwordPolicyResponse control
in every bind and compare response (when the request control is supplied) to
provide a strong indication to the client that the server is enforcing the
password policy.
By having the server indicate its support of the password policy to the
client at this early authentication stage, I don't think that it's required
for the control to be returned for any other operation, unless it is
conveying some useful information.

Clarification on this issue would be appreciated.

Thanks.
Andrew Sciberras

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 03 Sep 2003 15:51:57 -0600

You're right, it needs to be clarified.
 
The original intent was that the control is only returned when needed
(as specified), and not needed when operations suceed (and no extra
information needs to be returned).
 
We need to consider your reasons for returning the control for every
bind and compare.
 
Jim

>>> "Andrew Sciberras" <[email-masked]> 9/1/03 6:44:59 PM >>>
Hi,

I believe that there may be some ambiguity in the password policy
draft
(draft-behera-ldap-password-policy-06.txt) regarding the inclusion of
a
PasswordPolicyResponse control in LDAP response messages.

When the text discusses how various operations should be processed
(Section
6), it is very clear on what the passwordPolicyResponse control should
contain in each of the various erroneous and successful scenario's.
The text even goes to the extent of specifying that the control should
be
returned with an empty SEQUENCE for various bind and compare cases.

I believe the ambiguity lies with other operations (ADD for example),
where
the text does not specify whether a control should be returned if the
operation is completed successfully.
Typically I would assume that the absence of such text would mean that
a
control should not be returned. However this seems to conflict with
the
following description of the 'Response Control', which can be found in
section 5.2:
" If the client has sent a passwordPolicyRequest control, the server
sends this control with the following operation responses:
bindResponse, modifyResponse, addResponse, compareResponse and
possibly extendedResponse, to inform of various conditions....."

Although this sentence lacks any mandating words, such as MUST, I
interpret
it to mean that the passwordPolicyResponse control should always be
returned
for the previously mentioned operations, if a passwordPolicyRequest
control
was supplied in the original LDAP request.

I think that it is important to include the passwordPolicyResponse
control
in every bind and compare response (when the request control is
supplied) to
provide a strong indication to the client that the server is enforcing
the
password policy.
By having the server indicate its support of the password policy to
the
client at this early authentication stage, I don't think that it's
required
for the control to be returned for any other operation, unless it is
conveying some useful information.

Thanks.
Andrew Sciberras

---

From: "Andrew Sciberras" <[email-masked]>
Date: Thu, 4 Sep 2003 10:15:33 +1000

G'Day,

Take a look at the scenario of a bound entity changing their own
userPassword and including a passwordPolicyRequest control in the
LDAPMessage. (Where a passwordPolicy is in place for the userPassword
attribute).
By following the steps described in 6.2, if the operation succeeds, the user
will simply get an LDAPMessage back with a LDAPResult of `success' and no
passwordPolicyResponse control.
At this point in time the entity would have no idea as to whether a password
policy is being applied to their userPassword.
Receiving the successful response without a passwordPolicyResponse control
could mean:
    * The DSA knows nothing about the Password Policy control, and since it
was not marked as being critical, has just ignored it,
    * The DSA does support Password Policy controls, but no password policy
was applied to this `userPassword' attribute,
    * The DSA does support the Password Policy control, and a policy does
apply to the userPassword attribute.

If the intention of the Password Policy Specification is to suppress
returning controls on successful operations, then I think we need some way
to indicate to the client that a password policy is being applied to their
password.
I think an ideal time to do this is when the entity is using their password
to authenticate themselves in a bind or compare operation. By returning the
password policy control, even on a successful compare or bind, it makes the
entity aware that their password has a policy applied to it and that
subsequent operations performed on this password attribute will result in
the policy being enforced.

Regards,
Andrew Sciberras

  -----Original Message-----
  From: Jim Sermersheim [mailto:[email-masked]]
  Sent: Thursday, 4 September 2003 7:52
  To: [email-masked]; [email-masked]
  Subject: Re: [ldapext] Returning the Password Policy Control

  The original intent was that the control is only returned when needed (as
specified), and not needed when operations suceed (and no extra information
needs to be returned).

  We need to consider your reasons for returning the control for every bind
and compare.

  Jim

  Hi,

   <snip>

  I think that it is important to include the passwordPolicyResponse control
  in every bind and compare response (when the request control is supplied)
to
  provide a strong indication to the client that the server is enforcing the
  password policy.

  </snip>

   Thanks.
  Andrew Sciberras