Re: Authentication Methods for LDAP - last call

[Tim Howes <howes@netscape.com>]

Paul Leach wrote:
> 
> It won't help. Even if there were only one ACL per system (extremely
> unlikely), you can never get to all the systems to change it, because _any
> system in the world_ could have an ACL with the user's DN on it.

The statement that "It won't help" is just not true.
Perhaps you mean "It won't completely solve the problem".
That is certainly true. But it does help. In fact, it
helps quite a lot.

> Complete, up-to-date, knowledge in a distributed system is impossible.

This is a true statement. But you seem to imply that
the logical consequence of this is that complete, utter,
unmitigated chaos must reign. That's not true, except
perhaps in some computer science sense that is less than
interesting to anybody using the technology.
            -- Tim