Subject: RE: [ldapext] RE:draft-behera-ldap-password-policy-07.txt

From: "Howard Chu" <[email-masked]>
Date: Tue, 2 Mar 2004 22:48:14 -0800

Section 6 page 17 (top) again:
	In the event that the passwordPolicyRequest control
       was not sent, no passwordPolicyResponse control is returned.
                                      ^^^^^^^^

> -----Original Message-----
> From: Howard Chu [mailto:[email-masked]]

> From a purist's security perspective, I'd agree that
> invalidCredentials is the correct response. One of the maxims
> in security is to provide the minimal amount of information
> to an attacker. Thus, one is advised to avoid giving
> responses that differentiate between "account does not exist"
> / "password is incorrect" / "account locked due to too many
> failed attempts" ... Following this argument, I wouldn't even
> provide any special information in the passwordPolicyResponse control.

So I would change 6.1.1

      If the account is locked, the server MUST send a bindResponse to
      the client with the resultCode: invalidCredentials (49). The server
      MAY set the error: accountLocked (1) in the passwordPolicyResponse
      in the controls field of the bindResponse message.

I.e., I would like to leave it up to the admin to decide whether this error
code should be returned or not.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: Ludovic Poitou <[email-masked]>
Date: Wed, 03 Mar 2004 08:10:54 +0100

>       was not sent, no passwordPolicyResponse control is returned.
Thanks again.

>code should be returned or not.

This is a reasonable requirement that I'm inclined to include in the 
document.

Ludovic.

-- 
Ludovic Poitou
Directory Architect.
Directory Server Group, Grenoble, France
Sun Microsystems Inc.

Sun Microsystems requires the following notice:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTICE:  This email message is for the sole use of the intended
recipient(s) and may contain confidential and privileged
information.  Any unauthorized review, use, disclosure or
distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy
all copies of the original message.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~