RE: RFC2256: userPassword

[Paul Leach <paulle@microsoft.com>]

> -----Original Message-----
> From: Bruce Greenblatt [mailto:bgreenblatt@dtasi.com]
> Sent: Thursday, July 01, 1999 7:42 AM
> To: dboreham@netscape.com; ietf-ldapext@netscape.com
> Subject: Re: RFC2256: userPassword
> 
> 
> Novell Directory Service has this extremely useful operation "Verify
> Password" that is available through its API set.  This allows 
> third party
> applications to authenticate users to its service in a way that is
> integrated with the directory without acutally have to log in to the
> directory on their behalf.  So, the application knows the 
> user's password
> for an instant...  Is this type of operation generally useful???

It completely depends on how it is implemented. I don't see how it can be
secure and do less than logging in to the directory would do. So, unless
it;s just a convenience API wrapper around logging in to the directory, I'd
be suspicious of it.

Paul