I've noticed the ExtendedResponse for startTLS does not include the oid of the startTLS extension as rfc 2830 says it should (section 2.1). I've been testing against kurt's server at www.openLDAP.org. - Cameron Morris
At 09:51 AM 2002-02-07, CMorris@novell.com wrote: >I've noticed the ExtendedResponse for startTLS does not include the oid > >of the startTLS extension as rfc 2830 says it should (section 2.1). >I've been >testing against kurt's server at www.openLDAP.org. Per the current specification, yes, the OID of the request MUST be provided. IMO, that sentence: A Start TLS extended response MUST contain a responseName field which MUST be set to the same string as that in the responseName field present in the Start TLS extended request. should be: A Start TLS extended response MAY contain a responseName field. If responseName field is present, it MUST be set to the same string as that in the responseName field present in the Start TLS extended request. as clients MUST accept no responseName in certain error conditions (such as protocolError). I'll raise this issue to LDAPbis as they are currently working on the 2830bis draft.
changed notes changed state Open to Suspended moved from Incoming to Software Bugs
changed notes
moved from Software Bugs to Documentation
At 06:45 AM 5/27/2004, Kirill Kovalenko wrote: >2. Response > >Having fixed described above we came across another issues which concerns >TLS extended operation response. > >As RFC2830 states: > >... > A Start TLS extended response MUST contain a responseName field which > MUST be set to the same string as that in the responseName field > present in the Start TLS extended request. >... The specification here is considered to be in error here. An client which implements RFC 2830 must be capable of handling responses from servers which do not implement RFC 2830. And such a server cannot be expected to know what responseName to specify, this MUST is flawed. We are working with the IETF to revise the specification to note that responseName is optional (it really intended only for use with unsolicited notifications, not extended operation responses (as they are simply not needed)). >Unfortunately OpenLDAP server doesn't return the 'responseName' field. Why is it unfortunate? >This defect may prevent other LDAP APIs from understanding the response of >OpenLDAP servers. For instance, Microsoft LDAP API doesn't accept the >response without this field. We suggest to add the responseName field to the >response. It was previously reported that the Microsoft LDAP API implementation did not require the responseName field to be present. Please double check. Kurt
changed notes changed state Suspended to Closed
StartTLS I-D revised