Subject: RE: Basic Cert-2-Directory mapping question

From: "Slone, Skip" <[email-masked]>
Date: Thu, 11 Jan 2001 10:02:55 -0500

If LDAPv3 referrals were sufficient, we wouldn't be having this
conversation.  

LDAPv3 referrals WILL work in the following two cases:

1) where my server's administrator already knows how to find the target name
space, or
2) where my server and the server holding the target name space participate
in some fully-connected DIT in which unknown names are resolved by way of a
default referral up to a server maintaining the root naming context, from
where I can get a referral leading back down to the target.  (Extended
globally, this is the original X.500 vision; on a smaller scale, it's
practical for something like an industry-wide association.)

What I'm discussing is a way to fill in the gap where (1) my server does not
already know how to find a certain name space, and (2) there's a knowledge
disconnect between my server and the server holding the target. In this
case, LDAPv3 referrals WILL NOT work. 

 -- Skip

-----Original Message-----
From: Michael Ströder [mailto:[email-masked]]
Sent: Thursday, January 11, 2001 3:40 AM
To: [email-masked]
Subject: Re: Basic Cert-2-Directory mapping question

"Slone, Skip" wrote:
> 
> By way of example, what I'm talking about is the ability to
> take a DN of the form "cn=Skip Slone, o=Lockheed Martin, c=US" and
> determine that the LDAP server to check is found at (for example)
> ldap1.external.lmco.com.

Could be done with LDAPv3 referrals from your default LDAP server to
the target LDAP server holding the entry (e.g. described on
http://www.terena.nl/projects/direct/ for country-level
directories). I'm pretty sure Janus Liebregts and David Chadwick
know more about it.

Ciao, Michael.

---

From: Michael Ströder <[email-masked]>
Date: Thu, 11 Jan 2001 16:30:42 +0100

> If LDAPv3 referrals were sufficient, we wouldn't be having this

Who said that LDAPv3 referrals are the overall solution without
prior configuration?

> 2) where my server and the server holding the target name space
> participate in some fully-connected DIT 
> [..]

Yes.

> case, LDAPv3 referrals WILL NOT work.

Yes.

And RFC2377 does not work without SRV RRs. Yes. And I can't access
http://www.ietf.org without somebody having added the entry
www.ietf.org to DNS. Yes.  And... Yes.

No doubt, if you do not know any service access point or you don't
have any rule how to derive the service access point from an
information at hand you can't access the service. Yes.

Now about which *use-case* are we talking here?

Ciao, Michael.