Subject: Re: [ldapext] Re: draft-behera-ldap-password-policy-07.txt

From: "Jim Sermersheim" <[email-masked]>
Date: Tue, 16 Mar 2004 19:44:45 -0700

While your earlier suggestion of using fractions of seconds seems a
better fit for single-master systems, CSNs are really the only way that
I know of to guarantee non-duplication of incrementing values in a
multi-master system. In these systems, the replicaID is significant. If
we wish to ignore multi-master systems, then an integer counter works
fine.
 
As a side note, I believe that in most (or all) systems, either the CSN
timeCount or changeCount is extraneous. They were both needed to appease
two different schools of thought on the ordering of the values.

>>> Mark Ennis <[email-masked]> 3/16/04 5:07:46 PM >>>
I'd discourage the use of change sequence numbers as they add
extraneous 
information, specifically replicaID and changeCount, which is not 
relevant to the problem being addressed.

- Mark.

Jim Sermersheim wrote:

> True. For replication purposes, we picked timestamp over integer
counters.
> 
> I suggest we use change sequence numbers 
>
(http://www.ietf.org/internet-drafts/draft-sermersheim-ldap-csn-00.txt)
instead 
> of timestamps for these.
> 
> I also noticed that the quoted change below was made to Section 6.1 
> (bind), but not Section 6.4 (compare), I hope to consolidate these 
> nearly identical sections soon.
> 
> Jim
>

---

From: Mark Ennis <[email-masked]>
Date: Wed, 17 Mar 2004 14:37:36 +1100

Jim Sermersheim wrote:

> multi-master system. In these systems, the replicaID is significant.

I see your point. It would be useful if the ASN.1 definition of the CSN 
defined the replicaID and possibly both counters as optional (or with 
default values) if they are to be used in an environment designed for 
both replication and stand-alone systems.

> If we wish to ignore multi-master systems, then an integer counter works fine.

An integer counter does not allow determination of how many failures 
have occurred within a specified period of time, which I believe is one 
of the properties of the password policy.

> I'd discourage the use of change sequence numbers as they add extraneous

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 18 Mar 2004 16:52:41 -0800

At 07:37 PM 3/16/2004, Mark Ennis wrote:
>I see your point. It would be useful if the ASN.1 definition of the CSN defined the replicaID and possibly both counters as optional (or with default values) if they are to be used in an environment designed for both replication and stand-alone systems.

I suggest defaulting them each (replicaID and both counters) to zero.
I think making them optional would unnecessarily complicate comparison
logic.

Kurt