[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: RFC2256: userPassword


Bob Bick wrote:

> > You don't authenticate by client compare
> > of credentials, you authenticate by means
> > of the LDAP bind operation. Hence the password
> > validation mechanism is obscure to the client.
> 
> Wouldn't that be much slower (i.e. binding is slower than comparison).

No. (only one "no" this time).

> If a system desires to authenticate users based on LDAP, they desire to
> connect just once so that performance is reasonable.

Connect once, yes, but that's orthogonal to 
whether you use bind or compare. Note
that multiple consecutive bind operations may be sent
on a connection.