Re: ldapbis WG Last Call on ldapbis-syntaxes, ldapbis-strprep

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

>> If I understand you correctly, the part of [Models] 2.3 which I
>> quoted should be changed to something like
>>
>>  If the attribute type has an equality matching rule, any two values
>>  of the attribute must compare as false according to that matching
>>  rule.
>
> Yes.

In view of this, I'm beginning to dislike that Prohibit step.
If I have a purely local LDAP directory, why shouldn't I be allowed to
give an attribute two values where one uses a Private Use code point?
Or to search for - and find - the one with a Private Use code point by
searching for that exact string, at least?
The results of choosing to do this would of course be my responsibility.

I think it would be better if servers SHOULD implement the Prohibit step
but MAY allow it to be turned off, and recommend that managers keep it
turned on for globally accessible directories.

Then make the problem with certificate chain validation a problem for
certificates, not for string matching in general:  Either prohibit the
characters listed in the Prohibit step from existing in certificates, or
say that the Prohibit step MUST be performed when checking components of
certificates.  In either case, these characters won't match anything.

-- 
Hallvard