Re: RFC2255 - LDAP URL Format question...

[RL 'Bob' Morgan <rlmorgan@cac.washington.edu>]

> ..How does one indicate, in an LDAP URL, whether LDAP over SSL is to
> be used to contact an LDAP server at the ip address and socket
> specified in the LDAP url?
> 
> Seems like there needs to be another scheme defined...

Mark's response explains this well, though I might rather say that the use
of TLS is something about which the client and server can negotiate, among
many other things they can negotiate.  Ed, if your server wants to enforce
the use of TLS on connections made to it, then it merely has to be
configured to do so; and it can be made to do this without anyone having
to change the ldap:// URLs that may already be printed on the side of city
buses.  Moreover, a client can choose to use TLS protection, or Kerberos
or Digest protection, when making a URL-initiated LDAP connection,
whenever it wants to (assuming server agreement); unlike say with http://,
which tells the client *not* to use TLS.  You might want to look at
draft-ietf-tls-http-upgrade-02.txt, which proposes a way of getting even
http out of the https: tarpit.

 - RL "Bob"