Subject: Re: LDAPDN and AuthMeth/DIGEST-MD5

From: Mark Wahl <[email-masked]>
Date: Fri, 19 Nov 1999 19:21:02 -0600

So that I can ensure we're all consistent on what we're talking about, let me 
see if I can summarize each person's position. Note that these are in rough 
order of expression on the list so some (including mine) may have changed
since then.

Jeff Hodges: users should be permitted to use non-DNs as authorization
 identity, including 'short strings', in LDAP authentication mechanisms

Mark Wahl: Authorization identities need typing, and in situations where
 the authorization identity element syntax is a DN, it needs to be clear how 
 that is sent in a SASL Bind with DIGEST-MD5

Paul Leach: LDAP should not define a authorization identity string encoding
 that is in authmeth-04

Kurt Zeilenga: All authorization identities should be mappable to DNs or the
 authorization identity

Mark Wahl: The places which assume an authorization identity to be a DN 
 should be expanded, but this work should not be attempted by LDAPEXT for 
 LDAP alone, until we have a better handle on the formats of authorization 
 identities as used across multiple apps protocols with their acls 

Mark Wahl, Directory Product Architect
Innosoft International, Inc.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 19 Nov 1999 18:17:16 -0800

> let me see if I can summarize each person's position

My position is that users should be able to authenticate securely
regardless of whether they provide a DN or non-DN authorization
identity to the client.

I believe non-DN authorization identities should be encapulated
within an LDAPDN so as to avoid introduction of a second on-the-wire
representation of authorization identities.

I believe that the server, upon successful authentication, SHOULD
determine DN representing the user which is usable as the
creatorsname, modifiersname, ACL subjectDN, etc..  This DN may
or may not be the same DN provided by the client.

Lastly, the DIGEST-MD5 mechanism described by AuthMeth does
not work for DN-based authorization identities.  A canonical
utf8 representation of DNs is necessary.

----
Kurt D. Zeilenga		<[email-masked]>
Net Boolean Incorporated	<http://www.boolean.net/>

---

From: Jeff Hodges <[email-masked]>
Date: Sat, 20 Nov 1999 21:46:50 -0800

Thanks for summarizing Mark. It seems nominally correct, but there's a
fair amount of subtle-but-important stuff left out. For example, I
believe that the separate notions of authentication and authorization
are blurred together and thus confused in the overall discussion. 

I'm working on a more detailed analysis that I hope to post in the next
few days. 

JeffH
--
Jeff Hodges                                          [email-masked]
Staff Scientist                                 voice: +1 408 861 6656
Oblix Inc.                                        fax: +1 408 861 6810
18922 Forge Drive, Cupertino, CA 95014           main: +1 408 861 6800
Corporate........................................http://www.oblix.com/
Personal..............................http://www.stanford.edu/~hodges/