Subject: [ldapext] password policy: pwdAllowUserChange

From: "Jim Sermersheim" <[email-masked]>
Date: Thu, 13 May 2004 21:43:23 -0600

<in reference to draft-behera-ldap-password-policy-xx>

I'm not sure why we need this attribute. It's there to grant a user the
rights to change his own attribute. Are there implementations that need
this? It seems that local access control mechanisms should suffice.

I'd like to remove it unless there's a compelling reason to leave it.

Jim

_______________________________________________
Ldapext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ldapext

---

From: "Andrew Sciberras" <[email-masked]>
Date: Fri, 14 May 2004 14:56:04 +1000

Hi Jim,

I tend to agree with your here. I think that this an Access Control issue
and therefore should not be part of the policy.

I do not have any issues with its removal. Our directory can adequately
control access to attributes and their values using our local access control
and X.500 Basic Access Control implementations.

Removing the pwdAllowUserChange attribute may become a problem for Directory
implementations whose access control scheme cannot provide this
functionality. If this attribute stay's within the draft then I think that
text should be added to clearly indicate that the pwdAllowUserChange
attribute is intended to be used in absence of any access controls.

Cheers,
..........................
Andrew Sciberras
http://view500.adacel.com

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On
>Behalf Of
>Jim Sermersheim
>Sent: Friday, 14 May 2004 13:43
>To: [email-masked]
>Subject: [ldapext] password policy: pwdAllowUserChange
>
>