[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: [ldapext] Interaction of <draft-behera-ldap-password-policy> with authentication applications

Pierangelo Masarati wrote: 
^^^ you assume every authentication can be turned in a value compare;
for those cases, draft-behera is just fine, because it already accounts
for compare on the pwdAttribute as an authentication method.  However,
there are other password-based methods that need the value, not just a
yes/no.  This is what I'm discussing, and that's why I need separate
"lookup" and "done" methods; that's also why my needs are currently out
of the scope of draft-behera, requiring me to (re-)implement its logics
in the authentication application, using hacks to update the
authentication state info in the DSA.

As suggested, you could use a regular Bind operation to update the authentication state in the auxprop "done" method. As long as the done method is called in all cases, the lookup method doesn't need to trigger any updates, and the only extension we need is to define the ppolicy control behavior when accompanying a Search. I think this is a relatively benign change and ought to be rolled into draft-behera; it is at least as relevant as the current support for Compare operations.

--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/

_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www1.ietf.org/mailman/listinfo/ldapext