Subject: LDAP outcome entry

From: Dave CROCKER <[email-masked]>
Date: Mon, 22 Feb 2010 08:22:27 -0800

Folks,

I'd like to get a consensus assessment on the LDAP entry in the IETF Outcomes wiki:

    <http://trac.tools.ietf.org/misc/outcomes/wiki/IetfApplications#LDAP>

Specifically:

1.  Origin:  LDAP is an X.500 derivative, but it indeed might be more accurate 
to describe it as having been a fresh IETF effort that used X.500 as input. 
This would explain the current entry's Origina setting.  Does anyone disagree 
with the current entry's claim that LDAP originated in the IETF?

2.  Usage: My impression is that LDAP is hugely deployed and used within 
enterprises, so that the ++ is correct.  Yes?  I'm curious about the listing's 
asserting significant derivative work.  While it makes sense there would be 
this, I'd like to get confirmation here.

Thanks.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Eliot Lear <[email-masked]>
Date: Mon, 22 Feb 2010 17:46:14 +0100

Hi Dave,

As I see it there are two parts to LDAP- the transport and the schema.  
If you were to break it up as such, you could say that the transport had 
little to do with X.500 and the schema can be said to be a derivative 
work, based on experimental experiences of the Quippu folk, led by 
Marshall Rose & Steve Kille.

Eliot

On 2/22/10 5:22 PM, Dave CROCKER wrote:
> 1.  Origin:  LDAP is an X.500 derivative, but it indeed might be more 
> accurate to describe it as having been a fresh IETF effort that used 
> X.500 as input. This would explain the current entry's Origina 
> setting.  Does anyone disagree with the current entry's claim that 
> LDAP originated in the IETF?
>
>
> 2.  Usage: My impression is that LDAP is hugely deployed and used 
> within enterprises, so that the ++ is correct.  Yes?  I'm curious 
> about the listing's asserting significant derivative work.  While it 
> makes sense there would be this, I'd like to get confirmation here.
>
>
> Thanks.
>
> d/

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 22 Feb 2010 08:49:58 -0800

Eliot,

Thanks for the followup.  Your note makes sense.

If folks agree, can one of you LDAP devotees modify the existing entry to match 
this?

d/

On 2/22/2010 8:46 AM, Eliot Lear wrote:
>> setting. Does anyone disagree with the current entry's claim that LDAP
>> originated in the IETF?
>>
>>
>> within enterprises, so that the ++ is correct. Yes? I'm curious about
>> the listing's asserting significant derivative work. While it makes
>> sense there would be this, I'd like to get confirmation here.
>>
>>
>> Thanks.
>>
>> d/
>

-- 

   Dave Crocker

---

From: "Steve Kille" <[email-masked]>
Date: Mon, 22 Feb 2010 17:22:52 -0000

Dave, Eliot,

This got passed to me twice, so let me share a few thoughts.  I'm cc'ing
Kurt Zeilenga, who edited the last round of LDAP core specs, and Erik
Anderson who leads ongoing X.500 standardization

1.  LDAP was originally designed as a lightweight protocol to access X.500
servers.  (Tim Howes and Wengyik Yeong deserve a mention here).

2.  In LDAPv3, it was decoupled from X.500 to the extent that a server
implementing LDAP has no requirement to implement any of the X.500
protocols.

3.  Technically, LDAP is very much based on X.500, and references X.500.  It
is not an independent specification.   I consider it as alternate to the
X.500 DAP (which can now be used directly over TCP without an OSI stack).
X.500 defines the service and information model.   

4.  LDAP is a client access protocol only.   In a distributed directory, it
can be used with proprietary distribution (e.g., Microsoft AD) or with X.500
(which defines server to server protocols and access control).   (IETF
attempts to standardize access control and server/server protocols were
abandoned).

5.  Ongoing LDAP and X.500 standardization is tightly coordinated.
Changes were made in X.500(2009) to align it to LDAP!   

6.  I view that LDAP is very successful (although I am biased).   The most
widely deployed servers are LDAP only.   All X.500 servers that I know of
support LDAP, and use it as a primary client access mechanism.   X.500 is
offered by large vendors (CA and Siemens) as well as smaller companies, and
is important in deployments that need open server/sever interworking.

Hope this is of some help

Regards

Steve

> -----Original Message-----
> From: [email-masked] [mailto:apps-discuss-
> [email-masked]] On Behalf Of Eliot Lear
> Sent: 22 February 2010 16:46
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: LDAP outcome entry
> 
>   Hi Dave,
> 
> _______________________________________________
> Apps-Discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/apps-discuss

---

From: Dave CROCKER <[email-masked]>
Date: Mon, 22 Feb 2010 09:55:31 -0800

Steve,

Thanks!

I'd class your response as meaning that there need to be some changes to the 
Outcomes wiki and given your knowledge of the topic, doubt anyone is likely to 
assert different facts.  The changes should be done by you or someone with an 
LDAP background.  (I don't have nearly enough, plus I generlly want to encourage 
others to make changes.)

some inline comments:

> implementing LDAP has no requirement to implement any of the X.500

This suggests that LDAPv3 should get its own entry, to mark the differences from 
earlier version?

> Changes were made in X.500(2009) to align it to LDAP!

This prompted me to send a suggestion to the IAB that we should have a public 
listing of accomplishments that result of our liaison relationships. 
(Fax-over-Email was the first, but there have been others.)

> is important in deployments that need open server/sever interworking.

The intent behind + vs. ++ on the wiki is to distinguish between achieving some 
real adoption, versus achieving massive adoption (within the Target Segment.)

While LDAP is widely deployed -- for example in clients -- I don't have a feel 
for just how much actual /usage/ there is in enterprises.  Is it really massive?

d/
-- 

   Dave Crocker

---

From: "Steve Kille" <[email-masked]>
Date: Mon, 22 Feb 2010 18:03:14 -0000

> From: Dave CROCKER [mailto:[email-masked]]
> Sent: 22 February 2010 17:56
> To: Steve Kille
> Cc: 'Eliot Lear'; [email-masked]; 'Kurt Zeilenga'; 'Erik
> Andersen'

I don't think I'm going to have time to do this

> This suggests that LDAPv3 should get its own entry, to mark the

No, although I think the evolution is worth noting

> for just how much actual /usage/ there is in enterprises.  Is it really

I find it hard to judge, although it seems clear to me that a lot of
organizations use it, if only as a consequence of AD.    My sense is that it
ends up getting deployed, albeit without much visibility in a lot of places.

My disappointment, is that its use between organizations is limited.    This
seems a pity, as it could enable better sharing of information, and in
particular give access to X.509 certs to facilitate end to end encryption,
esp with S/MIME

Steve

---

From: Graham Klyne <[email-masked]>
Date: Tue, 23 Feb 2010 08:11:39 +0000

Dave CROCKER wrote:
> enterprises, so that the ++ is correct.  Yes?  I'm curious about the 
> listing's asserting significant derivative work.  While it makes sense 
> there would be this, I'd like to get confirmation here.

Some work I'm doing at the moment seems to indicate that Microsoft's
active directory service is significantly a combination of Kerberos and LDAP.
To the extent that AD "supports" LDAP, the ++ would seem to be justified [1].

AFAICT, LDAP is also widely deployed for authorization data in SSO
environments like University networks. It also appears to be a popular
authorization framework for use with Samba.

#g
-- 

[1] "AD added many features, the most important of which was LDAP support"
-- http://www.symas.com/documents/Adam-Eval1-0.pdf, cited by wikipedia
page on AD

---

From: Aaron Stone <[email-masked]>
Date: Tue, 23 Feb 2010 11:08:34 -0800

On Tue, Feb 23, 2010 at 12:11 AM, Graham Klyne <[email-masked]> wrote:
>> listing's asserting significant derivative work.  While it makes sense there
>> would be this, I'd like to get confirmation here.
>

Active Directory is a combination of Kerberos, LDAP, and Windows RPCs
for domain control. The LDAP part is quite interoperable since first
release in Windows 2000, the Kerberos part has become increasingly
interoperable, and the Windows RPCs and CIFS are now supported by
Samba (though I don't think CIFS ever made it off the ground for open
standardization).

I managed a fairly large Win2k domain, wrote several LDAP
authenticated web applications, and LDAP authentication for a mail
system, from 2001 to 2004, so I can definitely attest to deployment
and usefulness of this combination.

> environments like University networks.

Yep, my university and every company I've been at.

> It also appears to be a popular

I wish it were easier to deploy small setups for home and small
business users, though :\

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 23 Feb 2010 14:43:36 -0800

Folks,

Thanks for the followup on this.

Here are the claims I am hearing:

1. LDAP is very widely deployed and used in Enterprises.

2. Among that set, it has become a critical infrastructure service.

2. LDAP is not (widely) deployed or used across the open Internet, for use 
between random pairs.

I am not sure whether there are restrictions that should be applied, about the 
/type/ of Enterprise that is popular for LDAP use.  I'd guess medium-to-large 
Enterprises, more than small, but could imagine otherwise.  It's probably not 
essential to get agreement on this, but the agreement might solidify agreement 
about whether LDAP is essential.

If #1 and #2 are correct, I'd guess that LDAP should get a ++, rather than a +.

Do folks agree?  Disagree?

d/

ps. I'm still hoping someone who is deep in LDAP deployment and history can 
partition the entry into appropriate, distinct entries.
-- 

   Dave Crocker

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 23 Feb 2010 15:45:57 -0700

On 2/23/10 3:43 PM, Dave CROCKER wrote:
> 2. LDAP is not (widely) deployed or used across the open Internet, for
> use between random pairs.
> 
> I am not sure whether there are restrictions that should be applied,
> about the /type/ of Enterprise that is popular for LDAP use.  I'd guess
> medium-to-large Enterprises, more than small, but could imagine
> otherwise.  It's probably not essential to get agreement on this, but
> the agreement might solidify agreement about whether LDAP is essential.
> 

+1 to ++ :)