Re: comments on draft-ietf-ldapext-authmeth-01.txt

[howes@netscape.com (Tim Howes)]

I think requiring the creation of an entry is too large
a burden. But there's no requirement that the DN
you specify in an authentication request actually
corresponds to an entry in the tree. I'm just suggesting
that there may be defined algorithmic mappings from
an external auth id scheme (e.g., principal@realm in
kerberos) to a DN (e.g., krbname=principal@realm).
            -- Tim

Jeff.Hodges@stanford.edu wrote:

> Just to test my understanding..
>
> >  Explicitly state in the document
> > that other schemes can easily be encapsulated in the DN
> > syntax.
>
> By this I presume you're alluding to something akin to..
>
>   One may provide for mapping authorization (authz) identities which are
> expressed in syntactic forms *other* than DNs, by creating entries for the
> appropriate entities and providing the DN-to-foreign-authz-id mapping in those
> entries, per the recommendations in Section X.X of [docRefHere].
>
> ?
>
> thanks,
>
> Jeff