security considerations (Was: WG last call on the Java API)

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

I reiterate my request that a detailed security analysis should
be undertaken before the document is progressed to the IESG.  One
of the areas which concern me is the management of authentication
secrets by the API.  Also, a discussion of considerations
implementing API SASL and TLS features should be detailed.  In
particular, the handling of TLS alerts seems an area needing
some discussion.  There were security trade-off taken (in
referral chasing) which should be discussed in the I-D.  

Kurt