Subject: RE: [ldapext] Password policies in LDAP

From: "Dyer, Kevin" <[email-masked]>
Date: Thu, 20 Feb 2003 11:43:40 -0500

Jim,

These two RFC's do not address a number of issues that are discussed in the
draft; for instance the number of invalid login attempts, account lockout,
password checking, and password reuse. A large number of companies are
moving toward LDAP as their primary authentication mechanism for desktop and
network based applications. The Directory server must be able to address
issues related to password management and user control. Leaving it up to the
client is not an option anymore. I know that at least one company is
changing their Directory server to implement most of this draft as they
recognize the direction industry is taking.

		Kevin

____________________________________________ 
Kevin J. Dyer
Sr. Technologist, Product Management
[email-masked]

TEL:     978-322-2011
FAX:     978-441-0078
MOBILE:  978-549-0971

MatrixOne, Inc.
210 Littleton Rd
Westford, MA  01886  USA
www.matrixone.com

"Changing the way the world brings products to market" (tm)
____________________________________________

  >-----Original Message-----
  >From: Jim Willeke [mailto:[email-masked]]
  >Sent: Wednesday, February 19, 2003 4:52 AM
  >To: sreekantan, vijay
  >Cc: [email-masked]
  >Subject: Re: [ldapext] Password policies in LDAP
  >
  >
  >Have you seen Kurt's stuff ?
  >http://www.faqs.org/rfcs/rfc3062.html
  >
  >http://www.faqs.org/rfcs/rfc3112.html
  >-jim
  >
  >sreekantan, vijay wrote:
  >
  >> I was trying to understand more about standards related to 
  >Password 
  >> Policies in LDAP servers. I found that there was an internet draft 
  >> written by a group of people from Sun MicroSystems.
  >> draft-behera-ldap-password-policy-06.txt was the draft file name.
  >> I also found that this draft has been expired and was not 
  >made an RFC. 
  >> My question is if there is any standard on the password 
  >policies that 
  >> LDAP vendors should support. Is there any information 
  >regarding this. 
  >> What happens to expired drafts. If anybody could provide some 
  >> information on this topic, it will be greatly helpful.
  >> Regards
  >> Vijay
  >>
  >>
  >> 
  >-------------------------------------------------------------
  >-----------
  >> Do you Yahoo!?
  >> Yahoo! Shopping 
  >> 
  ><http://rd.yahoo.com/O=1/I=brandr/vday03/text/flow/*http://sh
opping.yahoo.com%0A/shop?d=browse&id=20146735> 
> - Send Flowers for Valentine's Day 

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "sreekantan, vijay" <[email-masked]>
Date: Thu, 20 Feb 2003 15:11:51 -0800 (PST)

Leaving it to the client (client of the LDAP server) requires us to implement policies in multiple platforms/clients which is a very bad and infeasible decision. I agree with Kevin that there should be some standards. I am just searching for the standards to prove some concepts in a security architecture project I am working on.
Vijay
 "Dyer, Kevin" <[email-masked]> wrote:
Jim, 

These two RFC's do not address a number of issues that are discussed in the draft; for instance the number of invalid login attempts, account lockout, password checking, and password reuse. A large number of companies are moving toward LDAP as their primary authentication mechanism for desktop and network based applications. The Directory server must be able to address issues related to password management and user control. Leaving it up to the client is not an option anymore. I know that at least one company is changing their Directory server to implement most of this draft as they recognize the direction industry is taking.

                Kevin 

TEL:     978-322-2011 
FAX:     978-441-0078 
MOBILE:  978-549-0971 

MatrixOne, Inc. 
210 Littleton Rd 
Westford, MA  01886  USA 
www.matrixone.com 

---------------------------------
Do you Yahoo!?
Yahoo! Tax Center - forms, calculators, tips, and more

---

From: "Bob Joslin" <[email-masked]>
Date: Thu, 20 Feb 2003 20:50:27 -0800

I completely agree.  And I too would like to see the password policy draft
progress in some form or other.

Bob
  -----Original Message-----
  From: [email-masked] [mailto:[email-masked]]On Behalf Of
sreekantan, vijay
  Sent: Thursday, February 20, 2003 3:12 PM
  To: [email-masked]; [email-masked]
  Cc: [email-masked]
  Subject: RE: [ldapext] Password policies in LDAP

  Leaving it to the client (client of the LDAP server) requires us to
implement policies in multiple platforms/clients which is a very bad and
infeasible decision. I agree with Kevin that there should be some standards.
I am just searching for the standards to prove some concepts in a security
architecture project I am working on.
  Vijay

    Jim,

    These two RFC's do not address a number of issues that are discussed in
the draft; for instance the number of invalid login attempts, account
lockout, password checking, and password reuse. A large number of companies
are moving toward LDAP as their primary authentication mechanism for desktop
and network based applications. The Directory server must be able to address
issues related to password management and user control. Leaving it up to the
client is not an option anymore. I know that at least one company is
changing their Directory server to implement most of this draft as they
recognize the direction industry is taking.

                    Kevin

    TEL:     978-322-2011
    FAX:     978-441-0078
    MOBILE:  978-549-0971

    MatrixOne, Inc.
    210 Littleton Rd
    Westford, MA  01886  USA
    www.matrixone.com

      >> LDAP vendors should support. Is there any information
    &nb! sp; >> What happens to expired drafts. If anybody could provide
some

----------------------------------------------------------------------------
--
  Do you Yahoo!?
  Yahoo! Tax Center - forms, calculators, tips, and more