Re: Compromise Authentication Proposal

[Robert Allen <robert.allen@Eng.Sun.COM>]

>>LDAP does not curreently have a formal way of specifying Access Control
>>Information.  This is required for multi-vendor interoperability when we
>>implement shadowing. Yet another future work item.

I hope this isn't too far in the "future".  The current
state of affairs with LDAP server ACLs is a major problem
with designing complex suites of LDAP clients who need
to install or upgrade additional ACLs for their objectclasses.
There are other issues, such as the inability to easily
(at all?) delegate the ability to create ACLs within a
naming context.  ACLs that don't cross replication
bounderies are another horrible inadequacy of the
LDAP "servers" that exist today.

Regards,

Robert Allen
rja@sun.com