Subject: RE: No-op LDAP ;binary option

From: Steve Hanna <[email-masked]>
Date: Wed, 20 Nov 2002 11:22:05 -0500

>> I *do* care how it gets encoded in LDAP. 
>
>So do I. That's why the PKIX LDAP PKI Schema ID ensures that the bits on the 
>line are exactly the same when userCertificates are requested in the new spec, 
>compared with userCertificates;binary in the old spec

Great. But the new schema document and the new LDAP specs no longer
include support for the ;binary option. Right? So that means
that old clients that ask for userCertificates;binary will get
an error from new servers that don't recognize the ;binary option
and new clients that ask for userCertificates will get an error
from old servers that believe you must use the ;binary option
to retrieve the userCertificates attribute. If I'm wrong, please
explain why.

It's not enough to have the same bits in the attribute value.
The new LDAP specs must also support the other features of the
existing protocol, including the ;binary option. Otherwise,
chaos will reign.

-Steve

---

From: [email-masked]
Date: Wed, 20 Nov 2002 18:26:19 -0000

From:           	Steve Hanna <[email-masked]>
Date sent:      	Wed, 20 Nov 2002 11:22:05 -0500
To:             	<[email-masked]>, <[email-masked]>,
  	"Ramsay, Ron" <[email-masked]>, "Russ Housley" <[email-masked]>
Copies to:      	"Hallvard B Furuseth" <[email-masked]>, <[email-masked]>
Send reply to:  	<[email-masked]>
Subject:        	RE: No-op LDAP ;binary option

> include support for the ;binary option. Right? 

Correct

>So that means

You are correct. I sent an email to the LDAPBis list last week that explained 
how this can be solved with a new LDAPv3 Control. I will circulate this to the 
PKIX list when I get my laptop back from the repairers (or if you have the 
message you could forward it for me)

regards

David