Re: Authmeth/DIGEST-MD5

["Kurt D. Zeilenga" <Kurt@OpenLDAP.Org>]

At 05:02 AM 7/22/99 +0000, RL 'Bob' Morgan wrote:
>You ask if the Bind Request name field DN should have a role in
>Digest in helping the client and server agree on what realm to
>authenticate in.  draft-leach-digest-sasl-03.txt says that the initial
>server challenge can contain multiple realm directives; the client
>chooses one to respond about.

Let's say a server is hosting two trees "o=left" and "o=right"
and that bind target entries contain an attribute that holds
a hashed user:realm:password where the realm is specific to
the tree: "left" and "right" respectively).

A server can not provide both realms to the client as only
the realm to which the person's stored hash contains would
produce a successful authentication.  It must provide the
realm that embedded in the stored hash within the target
entry.

If the target (DN) is not provided up front, then you disallow
hosting of independent DITS where storing of clear text
passwords is forbidden.

	Kurt