[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Revisited: effect of Start TLS on authentication state

At 12:38 AM 12/6/2003, Hallvard B Furuseth wrote:
>> The decision to keep or invalidate the established authentication and
>> authorization identities in place after TLS closure is a matter of local
>> server policy.
>
>Why?

The rationale is that servers are allowed, for any reason,
to invalidate the LDAP association.  It makes no sense to
say that they cannot do that as a result of TLS closure
when they could do otherwise.

>I don't remember any threads about problems with reverting to
>anonymous on TLS closure. 

(While I recall some previous discussions in this area,) the
proposal certainly was discussed at IETF#58.  Now it's being
taken to the list.  Hopefully we'll be able to close on it soon.

>Maybe there are current servers that don't do that, so the requirement that closure revert to anonymous would be an incompatible change? 

No, because clients today have to deal with instances where
the server, at the server's will, invalidate the LDAP association.

Kurt