ACL model & remote LDAP servers

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

draft-ietf-ldapext-acl-model-00.txt says:

>             The authentication service which validates the user's
>             logon needs to be able to retrieve ssai from the
>             directory, and create a credential which can be consumed
>             by the LDAP server or servers the subject needs to access
>             (This is represented by the arrows labelled 3. and 4. in
>             the diagram).

That's the only reference I can find to authentication across LDAP
servers.  Does it only mean that a user can authenticate to LDAP servers
that contain a replicates of his "master entry"?  Or are LDAP servers
allowed to ask other servers to check credentials?  (I don't think so.
The figure in section 2.3 says nothing about LDAP servers contacting
other LDAP servers to authenticate.  I think I have a point to add to
the LDAP ACL vs X.500 ACI comparison:-)

-- 
Hallvard