ldap password policy approach

["Kurt D. Zeilenga" <kurt@openldap.org>]

As I've was rereading this draft, a few things struck me as
being overly complex.  Most of this complexity is caused
by enforcing policy when modify used to set credentials.

An alternative approach would be use a control sent with a
BindRequest to specify new credentials.  Here is a little
food for thought.

Basically, a simple bind request would only return success if:
	1) access controls permitted the operation,
	2) proper credentials were provided, and
	3) password policy was satisfied.

If, for example, the credentials have expired, the bindResponse
contain an invalidCredentials result, an appropriate text
message, and, if LDAPv3, a control indicating the reason
why the credentials are considered invalid.

To set credentials, the client would send an LDAPv3 simple
bindRequest with the current credentials and a control
containing the new credentials.  If all is well and
a rebind was not required by policy, a success would be
returned.  Otherwise the response would contain an appropriate
result code and, if appropriate, a control providing additional
information (such as rebind required).

A new attribute type could be provided to store encrypted
credentials.  This attribute could have a syntax that supported
equality match of the appropriate hash of client provided
value with the stored hash value.  An attribute type option
(;binary?) to indicate that client value should be matched
directly against the stored value.

Additionally, a control (enforcePasswordPolicy) could be
defined, and specified with operations that modify the stored
credentials, that would enable password policy processing.
A well behaving 3rd party authentication application would
provide an enforcePasswordPolicy critical control.

I believe such an approach would eliminates much of the
complexity associated with implementing password policy codes
with both clients and servers.

If there are others interested in this alternative approach,
I'd be willing to work with them on an I-D.
 
	Kurt


----
Kurt D. Zeilenga <Kurt@OpenLDAP.org>
OpenLDAP Project <http://www.OpenLDAP.org/>