RE: RFC2256: userPassword

[Howard Chu <hyc@symas.com>]

> -----Original Message-----
> From: Paul Leach [mailto:paulle@microsoft.com]
> > -----Original Message-----
> > From: JR Heisey [mailto:jr.heisey@mediagate.com]
> > Sent: Thursday, July 01, 1999 2:15 PM
> > To: Paul Leach
> > Cc: ietf-ldapext@netscape.com
> > Subject: Re: RFC2256: userPassword

> > My problem with this is that it gives the third party
> > software access to all of my (assuming I'm the accounting
> > system user) access to LDAP user information and possibly
> > access to anything else that I have rights to. Which may or
> > may not be a problem.
>
> In _all_ the cases you presented, the third party software had your
> password, in the clear. In which case, if it isn't trustworthy, it has
> access to everything you hold dear. (Everything accessible with that
> password, anyway.)

True. But if you use Compare on some arbitrary attributes (other than
userPassword) then you at least haven't given away your entire LDAP account
all in one shot.

Are we getting closer or farther on this...