Re: Must a simple bind with DN and no pwd be treated as anonymous?

[RL 'Bob' Morgan <rlmorgan@cac.washington.edu>]

> Then how can the client tell the difference between "authentication by
> assertion" and authentication using credentials?  This seems to be the
> very problem that the Authentication Response Control was designed to
> solve, i.e. with what identity is the client currently bound?

If the client asserts a DN in a simple bind and supplies no password, then
(1) its assertion is accepted as such, or (2) it is bound anonymously, or
(3) it gets an authentication failure with a inappropriateAuthentication
response code.  You're exactly right that the availability of the
Authentication Response Control would allow the client to distinguish
between cases (1) and (2).  Again, any sensible deployment would not give
any privileges to an authorization identity that could be bound-to without
supplying any credentials.

 - RL "Bob"