Re: [ldapext] draft-behera-ldap-password-policy - bind behavior when pwd must be changed

[Ludovic Poitou <ludovic.poitou@Sun.COM>]

John McMeeking wrote:

> As I read this draft, if the password must be changed (after reset), the
> bind is successful, even if the client does not include the password policy
> request control.  This seems like a problem when the LDAP server is used
> only for authentication.  I would think that a bind in that case should
> fail -- on the assumption that there is a password policy aware application
> that can be used to change the password.  Otherwise, the user can continue
> to authenticate successfully, which seems to be in violation of the intent
> of the policy.
>
>  
Good remark.

> Should the bind procedure be changed to fail if the password must be
> changed because of being reset when there is no password policy control?
> And succeed, with the warning, if the control is present? 
I'd be tempted to say yes.
I also concur that this should be a SHOULD.
I believe that it will take a while before all clients use the password 
policy controls on all bind operations.

I will update the draft to discuss this issue and provide some 
recommandations.

Thanks for your comments,

Ludovic.

> I'd be tempted
> to say even then it should fail, but I'm not sure if clients like JNDI
> would be able to handle a control on a failure.  Or at least this concern
> discussed, possibly with the recommendation that servers should provide a
> means to chose this behavior?
>
>
> John  McMeeking
>
>
> _______________________________________________
> Ldapext mailing list
> Ldapext@ietf.org
> https://www1.ietf.org/mailman/listinfo/ldapext
>  

--
Ludovic Poitou
Directory Architect.
Directory Server Group, Grenoble, France
Sun Microsystems Inc.

Sun Microsystems requires the following notice:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTICE:  This email message is for the sole use of the intended
recipient(s) and may contain confidential and privileged
information.  Any unauthorized review, use, disclosure or
distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply email and destroy
all copies of the original message.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www1.ietf.org/mailman/listinfo/ldapext