Subject: Authmeth: bind without disclosing password

From: Hallvard B Furuseth <[email-masked]>
Date: Mon, 8 Sep 2003 23:17:11 +0200

Does [authmeth] standardize an authentication method which does not
disclose the user's password to the server?  If not, is there a suitable
method like that we could add?  For situations with untrusted servers,
or where there is a danger that users will be conned into contacting
hostile servers.

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 09 Sep 2003 11:25:20 -0700

At 02:17 PM 9/8/2003, Hallvard B Furuseth wrote:
>disclose the user's password to the server?

[authmeth] mandates that all LDAP implementations which support
an authentication mechanism to implement SASL/DIGEST-MD5.
SASL/DIGEST-MD5 does not expose the user's password to the
server.

Kurt