Subject: ldap scheme comment

From: Leif Johansson <[email-masked]>
Date: Sun, 27 Dec 1998 15:47:09 +0100

Forgive me if this is an FAQ/stupid question. I am not on the list
but the following caught my eye in the recent ldap scheme draft:
Why is there a separate authentication method for kerberos5 when 
there is no kerberos5 authentication method specified in rfc2251? 
The BindRequest looks like this:

	BindRequest ::= [APPLICATION 0] SEQUENCE {
                version                 INTEGER (1 .. 127),
                name                    LDAPDN,
                authentication          AuthenticationChoice }

        AuthenticationChoice ::= CHOICE {
                simple                  [0] OCTET STRING,
                                         -- 1 and 2 reserved
                sasl                    [3] SaslCredentials }

        SaslCredentials ::= SEQUENCE {
                mechanism               LDAPString,
                credentials             OCTET STRING OPTIONAL } 

Kerberos5 is done as a GSSAPI mechanism as (part of) a SASL bind.
The only thing which is not obtainable from protocol calls is
what GSSAPI mechanisms are supported. It might be apropriate to
specify those (a set of OIDS then) in the scheme, but not (imho)
kerberos5 as such.

	Best Regards
	Leif Johansson

Leif Johansson				Phone: +46 8 164541		
Department of Mathematics		Fax  : +46 8 6126717		
Stockholm University 			email: [email-masked] 	

    <This space is left blank for quotational and disclamatory purposes.>