[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: authmeth: unsupported <TLS+anonymous bind>
Roger,
I think we more clear as to what is required to implement, versus
what, if implemented, must be implemented in a particular way.
There may also be cases where implementation of an elective
feature may require implementation of some other feature, which
by itself, is elective.
RFC 2829 was a bit unclear to precise what was required to
implement (because of use of conditional phrasing). Per prior WG
discussions, I think should simply state:
All implementations which implement any authentication mechanism
(other than simple anonymous) MUST implement the SASL DIGEST-MD5
mechanism. All server MUST implement anonymous authentication.
For historical reasons, simple DN/password Bind should be RECOMMENDED.
However, where simple DN/password Bind is implemented, Start TLS
MUST be implemented. And, as recently discussed, servers SHOULD
(by default) disallow use of simple DN/password when adequate
security protections (e.g., TLS) have not been established.
As we have a mandatory-to-implement "strong" mechanism, including
support for both integrity and data confidential protections, there
is (IMO) insufficient (rfc2026/rfc2119) reason to mandate or
recommend implementation of TLS (Start TLS). Where TLS is implemented,
I also believe there is insufficient reason to mandate or recommend
support for simple anonymous, simple DN+password, and/or EXTERNAL.
These should all be optional.
Kurt
At 01:08 AM 2/16/2004, Roger Harrison wrote:
>For authmeth -10, the single, consolidated section on anonymous authentication now states that LDAP implementations MUST support anonymous authentication with no other qualifications. The fact that Start TLS is a required-to-implement operation implies that implementations MUST support anonymous authentication when TLS is established.
>
>Roger
>
>>>> Hallvard B Furuseth <h.b.furuseth@usit.uio.no> 1/3/2004 7:34:17 AM >>>
>authmeth-09 says:
>
>> 5. Anonymous Authentication
>
>> LDAP implementations MUST support anonymous authentication, as
>> defined in section 5.1.
>>
>> LDAP implementations MAY support anonymous authentication with TLS,
>> as defined in section 5.2.
>
>Huh? Why allow implementations to not support anonymous
>authentication on secure connections, but support it on insecure
>ones? I could understand it if it was the other way around - along
>with not implementing Simple Bind at all without TLS.
>
>--
>Hallvard