[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Extension: WG Last Call: draft-ietf-ldapbis-authmeth-15.txt

Section 3.1.4 Discovery of Resultant Security Level
This refers to 3.2.3 which does not exist. I can't tell what it was intended to reference.

Also there are many references to [Protocol] section 4.13.x.x which probably should now be 4.14.xx.

Section 3.1.5 Server Identity Check
This section talks about how a client must verify a server's name against the identity presented in the server's certificate. This clause
- The "*" wildcard character is allowed in the server name
provided by the user. If present, it matches only the left-most
label from the subjectAltName.
makes no sense to me. That implies that I can issue an ldap request to e.g. ldap://*.example.com, which at a glance means to perform a DNS zone transfer against example.com and then issue an LDAP query against every DNS host record that's returned. I don't see how it makes any sense for a user to provide wildcarded server names to a client. In RFC2830 it was clear that wildcard characters could be present in the certificate, and that usage makes sense. Why is the use of wildcards reversed here? This invalidates many already-deployed RFC2830-conforming server certificates, if nothing else.

Section 3.3
2nd bullet
	"confidentially" should be "confidentiality"

Kurt D. Zeilenga wrote: 
The WGLC will now close on Tuesday, 27 September 2005.
It is hoped that this extension will allow for additional
review and comment.  If you haven't commented already,
please take some time in the next few days to do so.

Thanks, Kurt

At 10:27 AM 9/19/2005, Kurt D. Zeilenga wrote: 
Please note this WGLC closes this Thursday!  Please review
and comment (and if you have no comments, drop a note to
chairs so).

-- Kurt

At 01:10 PM 9/6/2005, Kurt D. Zeilenga wrote: 
This message initiates a LDAPBIS Working Group Last Call on the
document:

Title: LDAP: Authentication Methods and Connection Level Security Mechanisms
Editor: R. Harrison
Filename: draft-ietf-ldapbis-authmeth-15.txt 


--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/