Subject: Re: [ldapext] RE:draft-behera-ldap-password-policy-07.txt

From: "Howard Chu" <[email-masked]>
Date: Tue, 2 Mar 2004 09:07:06 -0800

> From: =?ISO-8859-1?Q?Michael_Str=F6der?= <[email-masked]>
> Andrew Sciberras wrote:
>  >
>  > Section 6.1.2B (Page 20)
>  >
>  >>If the number of these failures is greater or equal to the
>  >>pwdMaxFailure attribute, the server MUST lock the account
>  >>by setting the value of the pwdAccountLockedTime attribute
>  >>to the current time. After locking the account, the server
>  >>MUST send a bindResponse to the client with the
>  >>resultCode: unwillingToPerform (53), and MUST include the
>  >>passwordPolicyResponse in the controls field of the
>  >>bindResponse message with the error: accountLocked (1).
>  >
>  >
> > I do not think that the return code should be
> unwillingToPerform. In this
> >  scenario, the user has got their password wrong and this incorrect
> > attempt has made the number of failures exceed the
> pwdMaxFailure limit.
> > In this case the reason why the operation (BIND) is going to fail is
> > because of the incorrect password. The fact that the number of bind
> > failures has exceeded a policy limit is just a consequence
> of that. For
> > this reason I believe that the resultCode should be
> invalidCredentials.
>
> Andrew, I understand the rationale of your argument but I'd
> like to see a
> different error code returned for LDAP applications which are
> not aware of
> draft-behera-ldap-password-policy. unwillingToPerform would somewhat
> indicate a final failure whereas invalidCredentials makes the
> LDAP client
> just pop-up another login window...

>From a purist's security perspective, I'd agree that invalidCredentials is
the correct response. One of the maxims in security is to provide the minimal
amount of information to an attacker. Thus, one is advised to avoid giving
responses that differentiate between "account does not exist" / "password is
incorrect" / "account locked due to too many failed attempts" ... Following
this argument, I wouldn't even provide any special information in the
passwordPolicyResponse control.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Andrew Sciberras" <[email-masked]>
Date: Wed, 3 Mar 2004 13:07:02 +1100

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On
>Behalf Of
>Howard Chu
>Sent: Wednesday, 3 March 2004 4:07
>To: [email-masked]
>Subject: Re: [ldapext] RE:draft-behera-ldap-password-policy-07.txt

<snip>

>... Following

Bringing us back to the question: When is the password policy control
returned?
* Always, or
* Every time important information needs to be conveyed, or
* Only for specific operations as stated in section 5.2
* Only for specific operations as stated in section 5.2 and important
information must be conveyed, or
* When the operation has succeeded/failed due to the password policy
regardless of the operation and whether we have important information to
convey.

(The above list is based on the fact that the client has provided a request
control)

Cheers,
Andrew Sciberras.

---

From: "Howard Chu" <[email-masked]>
Date: Tue, 2 Mar 2004 22:39:52 -0800

Section 7 page 27, shouldn't this be:

	In the event that the passwordPolicyRequest 
   control was not sent, no passwordPolicyResponse control is returned. 
                                          ^^^^^^^^

  -- Howard Chu

---

From: Ludovic Poitou <[email-masked]>
Date: Wed, 03 Mar 2004 08:04:11 +0100

Yes it should and it's been corrected now.
Thanks for pointing it out.

Ludovic.

-- 
Ludovic Poitou
Directory Architect.
Directory Server Group, Grenoble, France
Sun Microsystems Inc.

Sun Microsystems requires the following notice:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTICE:  This email message is for the sole use of the intended
recipient(s) and may contain confidential and privileged
information.  Any unauthorized review, use, disclosure or
distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy
all copies of the original message.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---

From: Michael Ströder <[email-masked]>
Date: Thu, 04 Mar 2004 08:12:26 +0100

> passwordPolicyResponse control.

This would make a password policy a 1st-level support nightmare. And it's 
security by obscurity which does not really work against serious attacks anyway.

Ciao, Michael.