Re: Comments on draft-zeilenga-ldap-authpasswd-01.txt

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 11:02 AM 2/18/00 -0800, Kurt D. Zeilenga wrote:
>I believe the use or not of multiple passwords for one identity
>is a matter of policy not storage.  The storage should allow
>for either policy to be implemented.  It's my intent for this
>draft to be policy neutral.

Note that enforcement of password change policy often
requires knowledge of the current and new passwords.  As
updates via normal LDAP operations upon authPassword use
hashed values, it is not possible for the server to
enforce any content based password change policy.

Servers which support such policies will need to disable
update via normal LDAP commands and provide separate
update mechanisms which provide the necessary content
(the user's current and/or new password).  passwd-exop
provides such a mechanism.

I add a comment regarding this to the draft.

Kurt