Subject: Re: LDAP schema?

From: Leif Johansson <[email-masked]>
Date: Tue, 12 Jun 2007 12:21:31 +0200

Jeffrey Hutzelman wrote:
> At our meeting in Prague, we discussed Leif's work on a Kerberos data
> model, and the question as to whether we should pick it up as a work
> item, along with development of an LDAP schema for Kerberos
> administration. There was general agreement that these go together,
> and the real question is whether we want to do the schema work.
>
> There was a lot of discussion on that question, and no clear answer. 
> A number of people supported such work, but others felt that the
> existing implementation-dependent protocols were adequate and that
> LDAP schema work at this time would be unnecessary and/or ineffective.
>
>
> I would like to see discussion from the working group on whether this
> item should be included in our charter.  I would especially like to
> hear from people who would be interested in working on this
> (contributing text, editing documents, reviewing, etc) if it is
> adopted as a work item.
>
> I'm going to include this item in the charter proposal I send later
> this week, with the understanding that it will be dropped unless there
> are both a consensus within the WG to include it and one or more
> volunteers to work on it.
>
> -- Jeff
>
As I said in Prague, I'm happy to work on this but I don't see what
impact we can have on
existing implementations today. I think that the discussions we had on
the information-
model draft were valuable and that the information model should be
published (if not by
the wg then by me as an individual draft) if for no other reason than to
document what
people used to think a KDC looked like :-)

I'm also convinced that the currently deployed schema (including the one
in Heimdal
which me and Luke Howard wrote a long time ago) are more or less flawed
due to a lack
of good understanding of the underlying information model. For instance
I think that
key management in particular is an area where the current approaches are
dangerously
week.

In Prague it was suggested that the fact that there already are widely
deployed schema
should not preclude work on this subject. In general I would agree but I
don't see the
pressing need for interoperability that will drive adoption of the
standard schema.

What does this mean? My opinion is that the information model should be
published as
an informational draft. I guess there might be value in doing a wg last
call on it but
that is mainly a question of wg resources and I'm happy to leave it up
to the chair and
the iesg. I'll try to revise and republish the information model i-d in
time for the meeting.

    Cheers Leif