[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: draft minutes from Chicago meeting
Phil,
I am not proposing any specific mechanism. Only that we clearly identify
the environment we are going to design for.
If the distributed model is lacking anything (and I think we can agree that
it does), we should perhaps focus on solving the problem ASAP?
Cheers, ....Erik.
-----------------------------------
Erik Skovgaard
GeoTrain Corp.
LDAP/X.500 Consulting and Training
http://www.geotrain.com
At 14:35 02/10/98 +0100, Phil Pinkerton wrote:
>
>>Phil,
>>
>>Think about it, how will you implement a multi-server domain?
>>
>>With CRAM-MD5 you have to configure the password for users on each server.
>>That may be fine for a few servers and a few non-anonymous users, but it
>>does not scale when you implement hundreds of servers and have millions of
>>users that require strong authentication.
>>
>>Hence, if you *only* mandate CRAM-MD5, you will only cater to the small
>>installations. That was the reason for my question.
>>
>
>
>This is really a failure of the distributed model in use rather than the
>protocol or the authentication mechanism. But let's not go down that road.
>
>What I fail to understand is how TLS with a clear text password over the top
>(as has been suggested) solves this problem. You've still got to
>authenticate the client at the LDAP level and give them an
>authorization-identity (?) so that you can apply access control, etc. If
>you are proposing TLS client authentication using certificates to validate a
>client then I can see how this would work and get around your distribution
>issues, but this is heavy to mandate when 90% (my guess) of the LDAP
>directory deployments out there are probably single-server.
>
>Regards, Phil
>
>
>