Re: draft minutes from Chicago meeting

[Phil Pinkerton <phil%jade@wg.icl.co.uk>]

>Phil,
>
>Think about it, how will you implement a multi-server domain?
>
>With CRAM-MD5 you have to configure the password for users on each server.
>That may be fine for a few servers and a few non-anonymous users, but it
>does not scale when you implement hundreds of servers and have millions of
>users that require strong authentication.
>
>Hence, if you *only* mandate CRAM-MD5, you will only cater to the small
>installations.  That was the reason for my question.
>


This is really a failure of the distributed model in use rather than the
protocol or the authentication mechanism.  But let's not go down that road.

What I fail to understand is how TLS with a clear text password over the top
(as has been suggested) solves this problem.  You've still got to
authenticate the client at the LDAP level and give them an
authorization-identity (?) so that you can apply access control, etc.  If
you are proposing TLS client authentication using certificates to validate a
client then I can see how this would work and get around your distribution
issues, but this is heavy to mandate when 90% (my guess) of the LDAP
directory deployments out there are probably single-server.

Regards, Phil