Subject: RE: [ldapext] Clarification of draft-behera-ldap-password-policy-07.txt

From: "Ramsay, Ron" <[email-masked]>
Date: Fri, 20 Feb 2004 12:57:16 +1100

Thanks, Andrew.

It seems to come down to two paradigms:

1) Always return a response control in response to a request control if password policy has been used (like the server-side sorting control)
2) Only return a response control if one of the fields is present.

As, I guess, it is not a client's business to be asking HOW they were authenticated, 2) would seem to do the trick.

Ron

-----Original Message-----
From: Andrew Sciberras [mailto:[email-masked]]
Sent: Friday, 20 February 2004 12:18
To: Ramsay, Ron
Cc: Ldapext (E-mail)
Subject: RE: [ldapext] Clarification of
draft-behera-ldap-password-policy-07.txt

Hi Ron,

>Hi Ludovic,

Although this wasn't addressed to me, i'll chuck in my $0.02 worth...

>I am seeking clarification regarding when the password-policy
>control response is returned. The -06 draft Section 5.1 says
>it is returned "when appropriate" and Section 5.2 says it is
>returned with "the following operation responses...."

The ambiguity in when the control should be returned has been brought up
before.
I'm not sure what the status of official archives of this mailling list are,
but if you go to this page:
http://news.gmane.org/gmane.ietf.ldapext
and scroll down to the 2nd of September, 2003, you'll see the discussion.

I'm not certain that this matter was resolved, however it may have been
decided that the purpose of the control was to convey additional
error/warning messages for the client.
This is inline with your point 'b', below.
My personal preference would be point 'a'. Always return the control;
populate it with information if required.

Some ambiguity still exists though, because:
	* the control is still returned at times (bind & compare) without any
information.
	* 5.2 states that the control will be returned with add operations (maybe
others aswell), however this is not always the case.

>
>Is it expected that the response control is
>a. always returned if the request control was present
>b. only returned if a status needs to be signalled
>c. returned if the operation is one of bind, modify, add, compare, or
>d. only returned if the operation is one of bind, modify, add,
>compare and a status needs to be signalled?

>When can we expect draft -07 to be published>
18/02/04

>Thanks,
>Ron

Cheers,
Andrew.

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Ramsay, Ron" <[email-masked]>
Date: Tue, 24 Feb 2004 11:40:30 +1100

Thanks, we've picked up the new draft.

On another matter, there is an error code 'accountLocked' which we would normally set if the user had exceeded their password retry count. However, we also have the capability of administratively locking the account and it would be helpful if we could distinguish the two cases, perhaps by:

  accountSuspended,       /* password retries exceeded */
  accountLocked           /* administrator has disabled this account */

or accountLocked and accountDisabled?

Thanks,

Ron

-----Original Message-----
From: Ludovic Poitou [mailto:[email-masked]]
Sent: Friday, 20 February 2004 22:03
To: Ramsay, Ron
Cc: [email-masked]
Subject: Re: Clarification of draft-behera-ldap-password-policy-07.txt

-07 has been published.
-08 intends to be published in April or May.

As for the clarification, my quick answer would be: always return when 
the request control is present. But I need to put some more thoughts on 
this.

Regards,

Ludovic.

Ramsay, Ron wrote:

>Hi Ludovic,
>
>I am seeking clarification regarding when the password-policy control response is returned. The -06 draft Section 5.1 says it is returned "when appropriate" and Section 5.2 says it is returned with "the following operation responses...."
>
>d. only returned if the operation is one of bind, modify, add, compare and a status needs to be signalled?
>

-- 
Ludovic Poitou
Directory Architect.
Directory Server Group, Grenoble, France
Sun Microsystems Inc.

Sun Microsystems requires the following notice:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTICE:  This email message is for the sole use of the intended
recipient(s) and may contain confidential and privileged
information.  Any unauthorized review, use, disclosure or
distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy
all copies of the original message.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---

From: "Ramsay, Ron" <[email-masked]>
Date: Tue, 24 Feb 2004 18:23:33 +1100

There is another issue that needs clarification, but I don't know if this has been raised before.

The ASN.1 specifications of the request and response control appear in the document as pieces of ASN.1 and not a 'module'. This leaves some doubt regarding whether tags are IMPLICIT or EXPLICIT. We are using the same default as the LDAP v3 module, namely IMPLCIT TAGS. It is not possible for two implementations to interwork if they are not using the same default tagging method. (The ASN.1 can be made independent of the tagging default by using the actual words EXPLICIT and IMPLICIT in hte ASN.1, but I would think it enough to note which metho dis assumed.)

Ron

-----Original Message-----
From: Ludovic Poitou [mailto:[email-masked]]
Sent: Friday, 20 February 2004 22:03
To: Ramsay, Ron
Cc: [email-masked]
Subject: Re: Clarification of draft-behera-ldap-password-policy-07.txt

-07 has been published.

Regards,

Ludovic.