Subject: [ldapext] password policy: generic features

From: Kurt Zeilenga <[email-masked]>
Date: Wed, 30 Jun 2010 13:39:41 -0700

The latest I-D contains an account idling feature.  This is yet another feature which is useful regardless of the mechanism being used for authentication.

At present, I favor separating such features into a separate "account policy" specification.  However in absence of an I-D actually detailing an "account policy" this note can be viewed as simply placing my view on the public record.   Or maybe just rework this specification to be an "account policy" specification with "password extensions".   :-)

-- Kurt

---

From: Howard Chu <[email-masked]>
Date: Wed, 30 Jun 2010 14:02:50 -0700

Kurt Zeilenga wrote:
> The latest I-D contains an account idling feature.  This is yet another
> feature which is useful regardless of the mechanism being used for
> authentication.
>
> At present, I favor separating such features into a separate "account
> policy" specification.  However in absence of an I-D actually detailing an
> "account policy" this note can be viewed as simply placing my view on the
> public record.   Or maybe just rework this specification to be an "account
> policy" specification with "password extensions".   :-)

I was just going to ask if that's where you were headed. Is this "account" 
policy, or perhaps "authentication policy"? It seems that broadening the title 
may be a good idea; splitting the spec may be harder because the two are 
interdependent.
-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

---

From: Kurt Zeilenga <[email-masked]>
Date: Wed, 30 Jun 2010 18:20:45 -0700

On Jun 30, 2010, at 2:02 PM, Howard Chu wrote:

> I was just going to ask if that's where you were headed.

Haven't thought too much about direction.  Just making comments as I re-implement this stuff, and thinking a bit about dealing with some long standing 'account policy' related feature requests.

> Is this "account" policy, or perhaps "authentication policy"?

Well, some of the facilities I'm thinking might be part of such a specification are about authorization not authentication, such as general account locking.

> It seems that broadening the title may be a good idea; splitting the spec may be harder because the two are interdependent.

Some things might do better with less interdependence... but that doesn't necessarily require splitting the specification.

-- Kurt