agenda for IETF LDAPEXT meeting

[Alan Lloyd <Alan.Lloyd@OpenDirectory.com.au>]

Dear all, although I cannot attend - There seems to be some major areas
that I would like addressed in LDAP and its security regimes.

Specifically we have a range of authentication techniques and
certificate based systems are available for TLS/SASL 509, etc. 
What I would like to see is how we do user-service authentication and
trusted directory operations (with signed operations) and how these are
propageted into (X.500) distributed directories. ie. signed dap can be
enveloped into signed DSP so one can have a user/trust to service regime
- and once the user has authenticated and applied ops to the service,
the service through its trusted DSP interfaces can "envelope" and
propagate that trust within the system.

The two areas that have holes IMHO in LDAP is a) the LDAP/TLS
authentication ..ie the magic between TLS/509 user authentication and
cert verification and how LDAP environments support that specifically if
the user is a mobile user - and dealing with signed LDAP in a way that
can be propagated as a trusted and vetted protocol in a distributed
directory service - as per signed DAP and DSP.

all thoughts would be welcome.

regards alan