Re: please publish ldap password policy draft

["Kurt D. Zeilenga" <kurt@openldap.org>]

At 06:16 PM 10/21/99 -0600, Jim Sermersheim wrote:
>>a) compare must use octetStringMatch
>This draft avoids talking about how the actual comparison takes place.

Well, I argue that you actual comparison (and other simple
operations) acting upon userPassword are already well defined
by existing specifications.

>>b) servers cannot encrypt (or hash) the password and store
>>   it in userPassword.
>I don't want to use this document to re-hash (he he) the whole 'syntax of userPassword' discussion we've had twice now.

That wasn't my point.  userPassword is what it is.  Two standard
track documents should not be in direct conflict.  The conflict
should be resolved before the I-D is progressed.

I believe it would be wise to not meantion userPassword in your
draft.  I suggest adding an attribute type to the policy which
describes the attribute type that stores the hashed password
value.  Then, if implementors and/or admins choose to abuse
userPassword, they do so... but at their own risk.

- Kurt



----
Kurt D. Zeilenga <Kurt@OpenLDAP.org>
OpenLDAP Project <http://www.OpenLDAP.org/>