Subject: Re: [ldapext] Samba and the password policy draft

From: Luke Howard <[email-masked]>
Date: Tue, 9 Mar 2004 13:51:45 +1100

>I'm wondering if there's something preventing the use of an NT/LM SASL
>mechanism to perform an LDAP SASL bind. Novell is beginning to look at
>doing just that and will contribute to the code if it's seen as
>beneficial. If this were available, the password policy could still be
>enforced by the LDAP server

For the record, this exists and is supported by Active Directory -- it
is the NTLM SASL mechanism. But, as Andrew pointed out, it buys you
nothing with pass-through authentication.
 
>Then for password modifications, there is RFC 3602. Do you think this
>is sufficient to update these kinds of passwords? 

In some cases you only have the user's keys, not their password. Perhaps
a control could be defined that extended RFC 3062 to support setting
keys.

-- Luke

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Andrew Bartlett <[email-masked]>
Date: Tue, 09 Mar 2004 15:00:35 +1100

> a control could be defined that extended RFC 3062 to support setting

Indeed, that would be useful.  Could direct setting of those attributes
be considered to be that operation?  That is already proposed as an
allowed way to change userPassword, I think.

Andrew Bartlett

-- 
Andrew Bartlett                                 [email-masked]
Manager, Authentication Subsystems, Samba Team  [email-masked]
Student Network Administrator, Hawker College   [email-masked]
http://samba.org     http://build.samba.org     http://hawkerc.net

---

From: Luke Howard <[email-masked]>
Date: Tue, 9 Mar 2004 17:11:46 +1100

>be considered to be that operation?

True. A set keys operation, though, would at least abstract the client
from caring about how the keys are represented in the directory, and
allow the server to enforce constraints that may not be appropriate in
the case of a normal directory update.

draft-ietf-krb-wg-kerberos-set-passwd-01.txt might be a good place to
start -- there was some talk at the Vienna IETF about extending this
to LDAP.

-- Luke

---

From: Luke Howard <[email-masked]>
Date: Tue, 9 Mar 2004 17:11:46 +1100

-- Luke

---

From: Andrew Bartlett <[email-masked]>
Date: Tue, 09 Mar 2004 15:00:35 +1100

Andrew Bartlett