Subject: RE: Password sync question

From: "Paul Leach" <[email-masked]>
Date: Wed, 12 Sep 2001 10:02:17 -0700

> -----Original Message-----
> From: Tim Bass [mailto:[email-masked]] 
> Sent: Wednesday, September 12, 2001 9:48 AM
> To: Paul Leach; Nicolas Williams; Matt Crawford; Boza, Tom
> Cc: [email-masked]
> Subject: Re: Password sync question
> 
> 
> Paul,
> 
> Then, if I interpret what you are saying correctly,  a non-MS 
> LDAP _write_ (with SSL, etc.) to a W2K domain controller/AD  
> will permit the non-MS LDAP process to change W2K user  (NOS) 
> passwords?
> 
> Is this correct?

That's right. I forgot to mention, in addition to SSL, the caller had
better be an admin, of course. Or be running as someone with the
permission to set passwords. There are other protocols that permit
password change if the caller can prove they know the current protocol
-- that is not possible using LDAP.

Paul

---

From: "Tim Bass" <[email-masked]>
Date: Wed, 12 Sep 2001 15:20:06 -0400

Thanks Paul,

There is another issue related to MS/AD/KV5 that needs
clarification and hope it is appropriate to discuss here,
since it is KV5 related, only indirectly.  However, the KV5/
AD implementation is tightly coupled  so I dare to ask:

One of our architecture teams recently built a meta-directory
service, federating AD domains under a single non-MS root
domain.     After designing this architecture, MS engineers
has informed our architects that it would not be possible
to _write_ to AD via the meta-directory service.   Futhermore:

Our team was informed that the only way to _write_ to AD
was to communicate directly with each AD domain controller;
essentially marginalizing the use of the meta-directory service.

I'm sure this description is 'missing some key elements' and
am hoping that you can be so kind to clarify in the KV5 WG.

Finest Regards, Tim

www.silkroad.com

----- Original Message -----
From: "Paul Leach" <[email-masked]>
To: "Tim Bass" <[email-masked]>; "Nicolas Williams"
<[email-masked]>; "Matt Crawford" <[email-masked]>; "Boza, Tom"
<[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, September 12, 2001 1:02 PM
Subject: RE: Password sync question