Subject: RE: No-op LDAP ;binary option

From: "Ramsay, Ron" <[email-masked]>
Date: Tue, 19 Nov 2002 12:49:07 +1100

;binary was a transfer option, that is, it should never have been part of
the storage of values.

-----Original Message-----
From: Hallvard B Furuseth [mailto:[email-masked]]
Sent: Monday, 18 November 2002 23:14
To: [email-masked]
Subject: No-op LDAP ;binary option

Three related suggestions for the ;binary LDAP option, moved here from
LDAPBIS since it is the PKIX group who "owns" the ";binary" question:

Define the ;binary option to have no effect on encoding, and trust the
syntax of the attribute to take care of encoding.

Thus, you can put "userCertificate" in the Directory if that's what your
clients need, "userCertificate;binary" - with the same encoding - if
that's what they need, or both if you have both types of clients.

Or, one could define ;binary to do nothing except that if the client
requests ;binary on an attribute, it receives it with ;binary - whether
or not the has ;binary in the directory.

Thus you could have "userCertificate" in the directory and clients would
by default receive that, but clients that wanted ;binary would still be
handled - provided that they explicitly asked for it.  Clients that want
userCertificate;binary but ask for userCertificate or ask for all
attributes would not be handled.  In this case you could not solve that
by having both userCertificate and userCertificate;binary in the same
entry in the directory.

Also, one could decide that if an attribute is stored with ;binary in
the directory but the client requests the attribute without ;binary, it
receives it without ;binary.

This handles a situation where the admin has put ;binary in the
directory because most clients want that, but where some clients want
the attribute without ;binary (and ask for it explicitly).  It breaks
clients that ask for userCertificate but want userCertificate;binary,
which is legal.  In this case it doesn't help if the admin added
;binary.

-- 
Hallvard

---

From: Russ Housley <[email-masked]>
Date: Mon, 18 Nov 2002 21:04:28 -0500

I do not care how this gets encoded in the darn LDAP protocol; however, 
certificate users need fetch the certificate as a binary blob.

---

From: Hallvard B Furuseth <[email-masked]>
Date: Tue, 19 Nov 2002 18:25:53 +0100

> certificate users need fetch the certificate as a binary blob.

The userCertificate attribute's syntax takes care of that.
That's why LDAPBIS now feels the ;binary option was unnecessary and
could be removed as far as transfer formats are concerned.

So my suggestins puerly address how to support programs that call the
attribute 'userCertificate;binary' and/or expect it to be called that
when it is read from the directory.

-- 
Hallvard