Re: [ldapext] draft-behera-ldap-password-policy - bind behavior when pwd must be changed

[Dejan Muhamedagic <dejan@hello-penguin.com>]

John,

On Wed, Nov 19, 2003 at 08:13:42AM -0600, John McMeeking wrote:
> 
[snip]
>
> What I feel is lacking in the draft is the distinction between a client
> that provides the password policy request control and a client that does
> not.
> - If no password policy control is present, a bind with a reset password
> should fail
> - If a password policy is present, a bind with a reset password should
> succeed with a reponse control returned as is currently stated in the
> draft.

How can LDAP server tell if the client supports password policy or
not?  All it knows is that they want to bind.

I agree that the security policy should be enforced at the server
and not at the client, but in this case we have no means to do
that without "breaking" clients which don't know how to read the
policy.

Cheers,

Dejan

_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www1.ietf.org/mailman/listinfo/ldapext