[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: draft-...-java-api-07-LDAPConnection.getAuthenticationPassword()

Steve Sonntag wrote:

> I agree, there ought to be a way to determine the type of authentication.
>
> I don't like returning null, though, as that means "no authentication has
> been performed" which may not be the case.  Maybe there ought to be
> a more generic function, i.e. return a credential and let the mechanism figure
> out what to do with it.

  That's hard. Credentials may not always pass through the SDK; they may be handled by the client independently (some SASL mechanism or LDAPBind). In the latter cases, I don't think there is any way for the SDK to obtain the credentials used in general. The Auth Response Control draft describes a way to get the authorization ID, but not the "password".

>
>
> LDAPRebindAuth has the same sort of problem, it is tied to a password, where it probably ought to
> be tied to a credential.  This class implies that you can only follow referrals if doing simple authentication.

  That's the purpose of LDAPRebindAuth. The LDAPBind variant is for doing arbitrary authentication on following referrals (i.e. doing anything necessary, including using SASL or any mechanism known to the client but not necessarily known to the SDK).

Rob

>
>
> - Steve Sonntag
>
> > Mark C Smith <mcs@netscape.com> 11-Oct-99 5:39:29 PM >>>
> >>Rob Weltman wrote:
> >>>
> >>> Steve Sonntag wrote:
> >>>
> >>> From draft-...-api-07
> >>>
> >>>  5.6.5 getAuthenticationPassword
> >>>     public String getAuthenticationPassword()
> >>>    Returns the password used for simple authentication by this object.
> >>>   null is returned if no authentication has been performed.
> >>>
> >>> Should there be a behavior defined when authentication is not simple?
> >>>
> >>  How about returning null?
> >>
> >>   Maybe there is a need for a method to determine the type of
> >> authentication in effect?
>
> > That sounds useful to me.
>
> --
> >Mark Smith
> >
>
> ------------------------
> Steve Sonntag
> Novell Directory Services
> +1 801 861 7097