Subject: [ldapext] password policy vs. shadowing/caching

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 2 Jul 2010 14:48:42 -0700

Not only does the spec continue to suffer from various issues in face of shadowing/caching, additional issues in this area have been introduced by features such as account idling.

Account idling relies on shared knowledge across a set of DSAs of last successful login, and nothing in LDAP/X.500 ensures such shared knowledge can be maintained.

I favor a base specification(s) which details policy mechanisms specifically designed to operate in a traditional LDAP/X.500 model (each entry held by one master, possibly multiple shadow and caching DSAs) without any reliance on distributed operations and possibly additional specifications (possibly as appendices to the base) discussing how the base specification could be enhanced through the use of distributed operations and other yet-to-be-specified extensions (to the protocol or models).

-- Kurt

---

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 2 Jul 2010 15:10:14 -0700

> I favor a base specification(s) which details policy mechanisms specifically designed to operate in a traditional LDAP/X.500 model (each entry held by one master, possibly multiple shadow and cachi…

I note that one of the distributed policy issues that would need to be addressed (possibly simply by discussion in security considerations) is DoS vulnerability introduced by replication of user-specific state information.  That is, there is a magnification attack here.

-- Kurt