Subject: Re: [ldapext] RE:draft-behera-ldap-password-policy-07.txt

From: Michael Ströder <[email-masked]>
Date: Mon, 01 Mar 2004 18:52:49 +0100

Andrew Sciberras wrote:
 >
 > Section 6.1.2B (Page 20)
 >
 >>If the number of these failures is greater or equal to the
 >>pwdMaxFailure attribute, the server MUST lock the account
 >>by setting the value of the pwdAccountLockedTime attribute
 >>to the current time. After locking the account, the server
 >>MUST send a bindResponse to the client with the
 >>resultCode: unwillingToPerform (53), and MUST include the
 >>passwordPolicyResponse in the controls field of the
 >>bindResponse message with the error: accountLocked (1).
 >
 >
> I do not think that the return code should be unwillingToPerform. In this
>  scenario, the user has got their password wrong and this incorrect
> attempt has made the number of failures exceed the pwdMaxFailure limit.
> In this case the reason why the operation (BIND) is going to fail is
> because of the incorrect password. The fact that the number of bind
> failures has exceeded a policy limit is just a consequence of that. For
> this reason I believe that the resultCode should be invalidCredentials.

Andrew, I understand the rationale of your argument but I'd like to see a 
different error code returned for LDAP applications which are not aware of 
draft-behera-ldap-password-policy. unwillingToPerform would somewhat 
indicate a final failure whereas invalidCredentials makes the LDAP client 
just pop-up another login window...

Ciao, Michael.

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext