Authmeth/DIGEST-MD5

["Kurt D. Zeilenga" <Kurt@OpenLDAP.Org>]

I've been experimenting with implementation of SASL/DIGEST-MD5.

The authmeth draft, section 8.1, does not state want the value of
the DN field should be in the client's initial bind request.
At first, I thought it should be empty (zero byte string).  However,
I now come to the conclusion that the target DN should be provided
on client's initial request to allow binding to servers which
authenticate for multiple realms and do not have access to (or did
not store) the cleartext password.

So, a few questions:

What should the value of the DN field be client's initial
BIND/SASL/DIGEST-MD5 request?

If empty, how should servers determine which realm to respond?

If non-empty, how should servers to clients providing empty DN?

What should the value of the DN field be for second request?

If value differs from initial request, what should the server's
response be?

I'm sure I won't be the last person needing such clarification... 
amending the AUTHMETH specification with such might be appropriate.

Thanks, Kurt