Re: passwords in the clear

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Chris,

authmeth 7.1 (Simple Authentication) says:

   LDAP implementations SHOULD NOT support authentication 
   with the "simple" authentication choice unless the data on the 
   connection is protected using TLS or other data confidentiality and 
   data integrity protection. 

Are you saying this is insufficient?  How about just adding '...and
servers MUST support a configuration which rejects "simple"
authentication unless such protection is in place.'

Or maybe that should be 'MUST by default reject...'.

-- 
Hallvard