Re: mapping identities RE: Compromise Authentication Proposal

[Jeff.Hodges@stanford.edu]

Just to point out: separating the concepts of "authentication identities" from 
"authorization identities", which is what this subthread is nominally about -- 
~is~ addressed in draft-ietf-ldapext-authmeth-02.txt (and in SASL (RFC2222)). 
See sections 5 and 11 in authmeth-02, and section 3 (para 6 & 7) in RFC2222.

Note that I am going to be (real soon now) moving authmeth-02:section-5 (back) 
into draft-ietf-ldapext-ldapv3-tls so that the latter may be progressed 
without dependence on authmeth.

Jeff