Re: New draft on knowledge references in LDAP

[Roland Hedberg <roland@catalogix.ac.se>]

Hi Alan,

> All very good - but what about systems where one has to authenticate the
> users.. and the referred to servers have to know all the users through their
> directory entries. The ...

Admittedly, this is a problem that the draft does not even try to solve.
 
> Therefore for LDAP referrals to work at all in this type of system the
> knowledge of the servers must be "public" to any user of the system.
..snip..
> I think the security considerations should say...Because distributed mutual
> authentication is not possible with LDAP servers - the referral knowledge
> must always be public.

I don't agree.

I can see usages where a organization would like to keep some
references hidden from the anonymous user, but accessible for
users that are authenticated. 
Worth noting in this case is that for some usages several users might 
be allowed to authenticate as the same entry and that therefore the 
amount of information that has to be replicated between cooperating 
servers are rather limited.

-- Roland
------------------------------------------------
Roland Hedberg      phone     : +47 23 08 29 96
Dalsveien 53        mobile(NO): +47 90 66 44 52
No-0775 Oslo        mobile(SE): +46 70 520 420 3
Norway