Subject: LDAP BIND follows referrals (or not)

From: "Timothy Hahn" <[email-masked]>
Date: Thu, 26 Jul 2001 16:10:07 -0400

Hello all,

It has come up again within our organization whether or not LDAP servers 
that implement the LDAP BIND operation should follow referrals during 
processing of this operation.

Given entries:

dn: cn=Tim, ou=development, o=ibm
objectclass: alias
aliasedobjectname: cn=Tim Hahn, dc=us, dc=ibm, dc=com
cn: Tim

dn: cn=Tim Hahn, dc=us, dc=ibm, dc=com
objectclass: person
cn: Tim Hahn
sn: Hahn
userpassword: xxxx

Should a BIND operation with parameters:

TYPE: SIMPLE
DN: cn=Tim, ou=development, o=ibm
PW: xxxx

follow the referral and use the "cn=Tim Hahn, dc=us, dc=ibm, dc=com" 
entry?

I believe the concensus on the list when this was last discussed was that 
the server SHOULD NOT follow the alias when processing the BIND operation. 
 Further, section 4.2 of draft-ietf-ldapbis-protocol-02.txt draft also 
reflects this.

This note is just to point this out and ensure that the current 
specification in draft-ietf-ldapbis-protocol-02.txt is what we (through 
concensus) agree on.

Thanks in advance,
Tim Hahn

Internet: [email-masked]
Internal: Timothy Hahn/Endicott/IBM@IBMUS or IBMUSM00(HAHNT)
phone: 607.752.6388     tie-line: 8/852.6388
fax: 607.752.3681

---

From: "Volpers, Helmut" <[email-masked]>
Date: Fri, 27 Jul 2001 12:40:13 +0200

I think you are right. We came to the conclusion that the Server should not
dereference aliases during a bind operation.
Additional the server should not follow referrals during a bind operation.
 
Helmut

-----Original Message-----
From: Timothy Hahn [mailto:[email-masked]]
Sent: Donnerstag, 26. Juli 2001 22:10
To: [email-masked]
Subject: LDAP BIND follows referrals (or not)

Hello all, 

Given entries: 

TYPE: SIMPLE 

follow the referral and use the "cn=Tim Hahn, dc=us, dc=ibm, dc=com" entry? 

Thanks in advance,
Tim Hahn