Re: C LDAP API: security considerations

[Mark Smith <mcs@netscape.com>]

Harald Tveit Alvestrand wrote:
> ...
> My concern is that a client should be *able* to behave in a way that is
> both non-malicious and secure; at the moment I don't think we're ready to
> standardize this, so following referrals should be done above the API layer
> that we're currently attempting to standardize.

This argues for removing all references to "automatic" referral chasing
from the C LDAP API draft.  As others have pointed out, automatic
referral chasing is under specified at present, so removing  it is a
sane thing to do.  But most clients would like an automatic option, so
if we do remove it we should tackle it in a subsequent document.

-- 
Mark Smith
iPlanet Directory Architect / Sun-Netscape Alliance
My words are my own, not my employer's.   Got LDAP?