Subject: RE: When to not deref aliases

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 21 Feb 2001 00:41:03 -0700

I believe the least harmful and most acceptable change regarding the fix to specify alias dereferencing is this:

Add "Note that the server SHOULD NOT perform any alias dereferencing in determining the object to bind as." to - name: in section 4.2 (bind)

Add: "Note that the server will not dereference any aliases in locating the entry to be changed." to -entry: in section 4.9 (mod dn)

Add: "Note that the server SHOULD NOT dereference any aliases in locating the entry to be compared with." to -entry: in section 4.10 (compare)

Let me know if you'd like to resurrect this issue. Otherwise, I'll update the protocol doc.

Jim

>>> "Jim Sermersheim" <[email-masked]> 1/31/01 6:22:04 PM >>>
Sorry, I miscommunicated what I intended to say. I meant to say there are those who think it should say (choice a): "The server SHOULD NOT perform any alias dereferencing in determining the object specified in the name" and others that would rather it say (choice b): "The server will not perform any alias dereferencing in determining the object specified in the name".

Replace my use of "MUST NOT" below with choice b.

>>> "Kurt D. Zeilenga" <[email-masked]> 1/31/01 5:56:33 PM >>>
Under the guidance provided by RFC 2119, Section 6 for use
of Imperatives, I do not believe there is sufficient reason to
use a "MUST NOT" here.

Kurt

At 05:26 PM 1/31/01 -0700, Jim Sermersheim wrote:
>>>> "Salter, Thomas A" <[email-masked]> 1/30/01 9:04:29 AM >>>
>>I finally found a definitive statement in X.511, 8.1.2 Directory Bind
>>arguments:  "If simple is used, it consists of a name (always the
>>distinguished name of an object), ... "
>>
>>Since aliases are entries but not objects they are explicitly excluded from
>>use in the Bind.
>>
>>I guess we are now all in agreement that an alias cannot be used as the DN
>>of a simple bind.
>
>This was pointed out in http://www.OpenLDAP.org/lists/ietf-ldapbis/200101/msg00018.html, http://www.OpenLDAP.org/lists/ietf-ldapbis/200101/msg00035.html, http://www.OpenLDAP.org/lists/ietf-ldapbis/200101/msg00109.html and another subthread.
>
>Through all of this, we _haven't_ been in agreement.
>
>After looking at this long-winded thread, I noticed that four people have settled on the SHOULD NOT proposal (kz, lp, hv, rr). While another four (th, rh, ts, js) now think it should be a MUST NOT. Let me know if your opinion is being mis-read.
>
>I believe that most people in the SHOULD NOT camp agree that the specification (X.511, 8.1.2) clearly disallows the name of an alias to be passed in a simple bind, but are settling on SHOULD NOT for interoperability reasons. I note that implementations that currently dereference during a bind have always been at odds with the specification (given one agrees with RFC 2251, 3.3 and Thomas's assesment of X.511, 8.1.2). And thus, I'm not sure why special considerations are being made. So far, I've only heard of two servers that do this (and it's optional on one of those).
>
>I also believe most people in the MUST NOT camp will reluctantly say they don't mind it being a SHOULD NOT.