[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Authz/Authc state upon start TLS
One additional comment on 1->StartTLS->3.
A StartTLS that asserts a TLS client identity should not automatically
imply or assert an LDAP authentication identity as shown in state 3.
State 3 should be no AuthID, no AuthzID as no bind has occurred. I
believe that any mapping of SASL client identity to the LDAP
authentication identity should be done upon SASL External bind.
----
Kurt D. Zeilenga <kurt@boolean.net>
Net Boolean Incorporated <http://www.boolean.net/>