Subject: Re: [ldapext] Unfinished business: password policy and VLV

From: Gavin Henry <[email-masked]>
Date: Fri, 01 Feb 2008 21:05:13 +0000

John McGarvey wrote:
> 
> LDAP password policy and VLV (scrolling view browsing) are implemented 
> by a number of LDAP servers, more or less in accordance with now expired 
> drafts.  Both of these extensions are quite valuable, and both now have 
> multiple independent implementations, but there are no corresponding 
> RFCs.  Is there a plan to get these drafts back on track?  It seems to 
> me that there should be.
> 

There was some discussion about VLV in November last year at:

http://www.openldap.org/lists/openldap-software/200711/msg00175.html
http://www.openldap.org/lists/openldap-software/200711/msg00184.html

-- 
Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 824887
E [email-masked]

Open Source. Open Solutions(tm).

http://www.suretecsystems.com/
_______________________________________________
Ldapext mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/ldapext

---

From: John McGarvey <[email-masked]>
Date: Fri, 1 Feb 2008 17:02:37 -0500

Gavin,

The links you point to describe what is in OpenLDAP.  The problem I 
observe is that there are a number of widely implemented features in 
directories from Sun and Microsoft and Novell and IBM and others, which 
are reasonably interoperable and based on RFC drafts, but for which there 
are no RFCs.  In addition to VLV and Password Policy, Persistent Search is 
another in this category.  Now, LCUP is arguably more complete than 
Persistent Search, but except for OpenLDAP, I don't know who implements 
it. 

The problem here is that we have some RFCs that are implemented in 0 or 1 
LDAP servers, and a few shared functions that many servers have for which 
there are no RFCs.  One goal of the RFCs is to promote interoperability, 
and so it would be good if we had RFCs for Persistent Search, Password 
Policy, and VLV.

Regards,

John McGarvey
IBM directory architect

-- 
Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 824887

---

From: Gavin Henry <[email-masked]>
Date: Fri, 01 Feb 2008 22:27:03 +0000

John McGarvey wrote:
> are reasonably interoperable and based on RFC drafts, but for which 
> there are no RFCs.  In addition to VLV and Password Policy, Persistent 
> Search is another in this category.  Now, LCUP is arguably more complete 
> than Persistent Search, but except for OpenLDAP, I don't know who 
> implements it.  
> 
> The problem here is that we have some RFCs that are implemented in 0 or 
> 1 LDAP servers, and a few shared functions that many servers have for 
> which there are no RFCs.  One goal of the RFCs is to promote 
> interoperability, and so it would be good if we had RFCs for Persistent 
> Search, Password Policy, and VLV.
> 

Sure, that is a great goal, but if all the vendors have some varying 
degree of these features already, how likely is it that an RFC would be 
implemented so far down the line?

I know it would be quick for some of the features you list with OpenLDAP.

-- 
Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 824887

---

From: Kurt Zeilenga <[email-masked]>
Date: Mon, 11 Feb 2008 10:08:17 -0800

On Jan 24, 2008, at 11:18 AM, John McGarvey wrote:

>
> LDAP password policy and VLV (scrolling view browsing) are  
> implemented by a number of LDAP servers, more or less in accordance  
> with now expired drafts.  Both of these extensions are quite  
> valuable, and both now have multiple independent implementations,  
> but there are no corresponding RFCs.  Is there a plan to get these  
> drafts back on track?  It seems to me that there should be.

I am presently working in the area of password policy.  I hope to have  
a few drafts (yes, more than one) submitted soon.  One I-D will be a  
password policy proposal based on, but different than, the old behera  
I-D.  This I-D will be targeted for both the IETF standards track and  
ITU/ISO standard.  A second I-D will contain Experimental extensions  
to work with RFC 2307 passwords, e.g. {SSHA}xxxx.  A third I-D will  
contain related (but not password authentication specific) features,  
such as "account locking".  This I-D will be aimed at IETF standards  
track.

Given the history of competing VLV proposals and standards work, I  
would shooting for Informational.  In particular, I suggest  
documenting what folks have implemented in this area as opposed to  
producing a new VLV standard.  Any attempt to produce a VLV standards  
would quickly find itself revisiting all the issues LDAPext faced (but  
didn't resolve) during it last year(s).

-- Kurt

---

From: John McGarvey <[email-masked]>
Date: Mon, 11 Feb 2008 14:36:59 -0500

Kurt,

It seems questionable to introduce a new password policy approach when 
many existing servers implement a form of the Behera draft.  I suspect 
that the result would not be widely implemented. 

In addition to VLV and password policy, another LDAP draft that has seen 
wide implementation is persistent search.

My thought on each of these is that the now expired drafts should be 
renewed and discussed, with a view towards documenting current de facto 
standards.

Regards,
John McGarvey