
From nobody Wed Nov 18 08:02:08 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60D8F1B3877 for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 08:02:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.8
X-Spam-Level: 
X-Spam-Status: No, score=0.8 tagged_above=-999 required=5 tests=[BAYES_50=0.8] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YAoDxXArIPoS for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 08:02:04 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.141]) by ietfa.amsl.com (Postfix) with ESMTP id 8C6D61B3875 for <ldapext@ietf.org>; Wed, 18 Nov 2015 08:02:04 -0800 (PST)
Received: from host86-145-75-25.range86-145.btcentralplus.com ([86.145.75.25] helo=[192.168.1.67]) by mail5.atlas.pipex.net with esmtpa (Exim 4.71) (envelope-from <dbis@proseconsulting.co.uk>) id 1Zz5AS-0004an-Dg for ldapext@ietf.org; Wed, 18 Nov 2015 16:02:03 +0000
To: ldapext <ldapext@ietf.org>
From: Mark R Bannister <dbis@proseconsulting.co.uk>
Message-ID: <564CA0C0.9010400@proseconsulting.co.uk>
Date: Wed, 18 Nov 2015 16:01:04 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/gdph9d4-l8DhC5xeSxQT-rX5Ybk>
Subject: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2015 16:02:07 -0000

Hi,

Further to the announcement of the new LDAPEXT charter at LDAPCon next 
week, please can I confirm that this will continue to be the mailing 
list for those discussions, or is a new mailing list being set-up?

When will the new charter be published for all to see and comment on?

Also, I understood from last week that RFC2307bis will be on the 
charter, but DBIS (which is intended as its replacement) will not be, 
and the reasons given were:

1. There is only a single implementation.
2. It would take more than a year to complete.

I'm a bit puzzled by (1), as I'm sure there are RFCs based on single 
implementations.  However, clarification of that rule will be helpful.  
It will be very hard to convince others to produce their own software 
implementations of DBIS if the reference implementation already 
available does the job, so I'm not sure I understand the purpose of the 
rule.

Re (2), given the internet drafts are already written and the reference 
implementation is complete and fully functional, I fail to see where the 
evidence comes from that suggests it will take more than 1 year to 
complete?  Can you please provide a breakdown of the steps that would be 
involved and why you think DBIS will take more than 1 year.

I am in conversation at the moment with others regarding further 
features that could be introduced into DBIS to make it even better, I 
hope to bring those conversations to this mailing list soon, as I would 
be very interested in soliciting more opinions on this subject.

Thanks & regards,
Mark Bannister.


From nobody Wed Nov 18 08:22:39 2015
Return-Path: <dev+ietf@seantek.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E84731B38D3 for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 08:22:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.601
X-Spam-Level: 
X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eVYvt_tkh56E for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 08:22:36 -0800 (PST)
Received: from mxout-08.mxes.net (mxout-08.mxes.net [216.86.168.183]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8345E1B38E4 for <ldapext@ietf.org>; Wed, 18 Nov 2015 08:22:18 -0800 (PST)
Received: from [192.168.123.7] (unknown [75.83.2.34]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTPSA id 66647509BF for <ldapext@ietf.org>; Wed, 18 Nov 2015 11:22:17 -0500 (EST)
To: ldapext@ietf.org
References: <564CA0C0.9010400@proseconsulting.co.uk>
From: Sean Leonard <dev+ietf@seantek.com>
Message-ID: <564CA551.5040700@seantek.com>
Date: Wed, 18 Nov 2015 08:20:33 -0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <564CA0C0.9010400@proseconsulting.co.uk>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030401050208040904040902"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/9g8n6xJ4O7bMb8exs8rpsyLzAMA>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2015 16:22:38 -0000

This is a cryptographically signed message in MIME format.

--------------ms030401050208040904040902
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: quoted-printable

On 11/18/2015 8:01 AM, Mark R Bannister wrote:
> Hi,
>
> Further to the announcement of the new LDAPEXT charter at LDAPCon next =

> week, please can I confirm that this will continue to be the mailing=20
> list for those discussions, or is a new mailing list being set-up?

Yes, this will continue to be the mailing list for those discussions.=20
(Note that I am one participant, not even a charter author or anything,=20
and therefore only have one vote.)

If you find out any information to the contrary, please post it to this=20
list so people can migrate elsewhere.

>
> When will the new charter be published for all to see and comment on?

Haven't seen a thing.

Sean



--------------ms030401050208040904040902
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
CfYwggSvMIIDl6ADAgECAhEA4CPLFRKDU4mtYW56VGdrITANBgkqhkiG9w0BAQsFADBvMQsw
CQYDVQQGEwJTRTEUMBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4
dGVybmFsIFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
MB4XDTE0MTIyMjAwMDAwMFoXDTIwMDUzMDEwNDgzOFowgZsxCzAJBgNVBAYTAkdCMRswGQYD
VQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNP
TU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVu
dGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAImxDdp6UxlOcFIdvFamBia3uEngludRq/HwWhNJFaO0jBtgvHpRQqd5jKQi3xdh
TpHVdiMKFNNKAn+2HQmAbqUEPdm6uxb+oYepLkNSQxZ8rzJQyKZPWukI2M+TJZx7iOgwZOak
+FaA/SokFDMXmaxE5WmLo0YGS8Iz1OlAnwawsayTQLm1CJM6nCpToxDbPSBhPFUDjtlOdiUC
ISn6o3xxdk/u4V+B6ftUgNvDezVSt4TeIj0sMC0xf1m9UjewM2ktQ+v61qXxl3dnUYzZ7ifr
vKUHOHaMpKk4/9+M9QOsSb7K93OZOg8yq5yVOhM9DkY6V3RhUL7GQD/L5OKfoiECAwEAAaOC
ARcwggETMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0GA1UdDgQWBBSSYWuC
4aKgqk/sZ/HCo/e0gADB7DAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAd
BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEQYDVR0gBAowCDAGBgRVHSAAMEQGA1Ud
HwQ9MDswOaA3oDWGM2h0dHA6Ly9jcmwudXNlcnRydXN0LmNvbS9BZGRUcnVzdEV4dGVybmFs
Q0FSb290LmNybDA1BggrBgEFBQcBAQQpMCcwJQYIKwYBBQUHMAGGGWh0dHA6Ly9vY3NwLnVz
ZXJ0cnVzdC5jb20wDQYJKoZIhvcNAQELBQADggEBABsqbqxVwTqriMXY7c1V86prYSvACRAj
mQ/FZmpvsfW0tXdeDwJhAN99Bf4Ss6SAgAD8+x1banICCkG8BbrBWNUmwurVTYT7/oKYz1gb
4yJjnFL4uwU2q31Ypd6rO2Pl2tVz7+zg+3vio//wQiOcyraNTT7kSxgDsqgt1Ni7QkuQaYUQ
26Y3NOh74AEQpZzKOsefT4g0bopl0BqKu6ncyso20fT8wmQpNa/WsadxEdIDQ7GPPprsnjJT
9HaSyoY0B7ksyuYcStiZDcGG4pCS+1pCaiMhEOllx/XVu37qjIUgAmLq0ToHLFnFmTPyOInl
tukWeh95FPZKEBom+nyK+5swggU/MIIEJ6ADAgECAhAaQkrPJ/nEG3M8lirbnsnnMA0GCSqG
SIb3DQEBCwUAMIGbMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVy
MRAwDgYDVQQHEwdTYWxmb3JkMRowGAYDVQQKExFDT01PRE8gQ0EgTGltaXRlZDFBMD8GA1UE
AxM4Q09NT0RPIFNIQS0yNTYgQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBTZWN1cmUgRW1h
aWwgQ0EwHhcNMTUwMjAyMDAwMDAwWhcNMTYwMjAyMjM1OTU5WjAlMSMwIQYJKoZIhvcNAQkB
FhRkZXYraWV0ZkBzZWFudGVrLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AM+J9tKgDs1LQtaDc+c4E58tCUQRNZiWbM1drOhLq2oSj75LuxPrrZy4XGjWoQFq9qGYHgiv
boRKoo2guKi2R5xrf/pZ27ELY5jCa3BQs4Q2YwziXWM5rktnFL2amO2MMwhuo0n7OIMDYftv
TEun2mOrnJ3G53zvawQdMbuRiHSNwc7DzWJwAjZQWFO8OF+BgNPzMDQGmzYQ4MVNk8NX5ecN
VbfusUU1wZOlfdy8lWTfcASDqa9jLoaAiSx2ay4q7/5m0BOWqOKZCS0f7MmIUtSqODEoiZkd
7oCj5MRKOg2ZLia33JN+oS5rTKN8rs4u4ZF5g8zypHS5TY/l3pNRlrcCAwEAAaOCAfIwggHu
MB8GA1UdIwQYMBaAFJJha4LhoqCqT+xn8cKj97SAAMHsMB0GA1UdDgQWBBQaZuXe8vDwU+ja
pyFW3zSvIW6TxjAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggr
BgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0wOwYM
KwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQv
Q1BTMF0GA1UdHwRWMFQwUqBQoE6GTGh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0NPTU9ET1NI
QTI1NkNsaWVudEF1dGhlbnRpY2F0aW9uYW5kU2VjdXJlRW1haWxDQS5jcmwwgZAGCCsGAQUF
BwEBBIGDMIGAMFgGCCsGAQUFBzAChkxodHRwOi8vY3J0LmNvbW9kb2NhLmNvbS9DT01PRE9T
SEEyNTZDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3VyZUVtYWlsQ0EuY3J0MCQGCCsGAQUF
BzABhhhodHRwOi8vb2NzcC5jb21vZG9jYS5jb20wHwYDVR0RBBgwFoEUZGV2K2lldGZAc2Vh
bnRlay5jb20wDQYJKoZIhvcNAQELBQADggEBAHiH/zXr779dLLJNLp6yW/RQvJSYuNbEqauQ
BWLZgvCF8FJjcS+y+bhN7RpTSVaEymbxnpJWFg0Qs6us6rXtttU6MF2JhTuxtu6yWW0EYy80
KGOt6zJRTxa46kAhAOqw4KPQ5RTvf/NT+2Qu8b2edlh+3t6f8iTQOAL/BNHnmr4QvpfnMLa8
NMAqd4FLOcSU9JKBlb5YtsEdfM3nBt4m95pfhpww79gB+zoXMoVaI+lfQHhkGth6mlaTkFUV
DT2pqq98XgESpObFEngb8ZRftBVoZfgJ4ajXcZnhKaqYEr23EtY207KgKb4LAXA84wtPcFfJ
rQaDArapR7xd2GNs+eYxggRBMIIEPQIBATCBsDCBmzELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RP
IENBIExpbWl0ZWQxQTA/BgNVBAMTOENPTU9ETyBTSEEtMjU2IENsaWVudCBBdXRoZW50aWNh
dGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBAhAaQkrPJ/nEG3M8lirbnsnnMA0GCWCGSAFlAwQC
AQUAoIICYTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNTEx
MTgxNjIwMzNaMC8GCSqGSIb3DQEJBDEiBCCJHGM0QnZYPlzNmisfyZwV3kRQVwBQD5kzb5O3
WrclxDBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZI
hvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3
DQMCAgEoMIHBBgkrBgEEAYI3EAQxgbMwgbAwgZsxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJH
cmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBD
QSBMaW1pdGVkMUEwPwYDVQQDEzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVudGljYXRp
b24gYW5kIFNlY3VyZSBFbWFpbCBDQQIQGkJKzyf5xBtzPJYq257J5zCBwwYLKoZIhvcNAQkQ
AgsxgbOggbAwgZsxCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIx
EDAOBgNVBAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMUEwPwYDVQQD
EzhDT01PRE8gU0hBLTI1NiBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFp
bCBDQQIQGkJKzyf5xBtzPJYq257J5zANBgkqhkiG9w0BAQEFAASCAQCOt9fFlceOUj1EQfZN
0bgtG3o/ALh8WQMq5FrtH1JUm+BMOgvKRXpm6+N+RY/AHEAM+yZ6nnBxczx6QFCehmvNEpeD
tbqCgqm4hQjs/DCZvy+9H3KhZ+JLoVBNvXYvKlXOnlVZt14Cn46k0wbdsuOJZS/o8feLus0/
TRljRHTfGRKeSymeamfh/NQNcx7iBqX2rsBOgaKC70MIXcylK88rE3ls/kHdgzNdGc2EEfC5
XfpNRop2+5z2hG4UD6GwSDni/CzFNWF44eTgYuFGcGE6zyIgopGYmSsoWWGmcrRgHl+VC8Ka
g6yBaB5X2hfL7gr3qU2wT6YO3sAOSfs/xq/wAAAAAAAA
--------------ms030401050208040904040902--


From nobody Wed Nov 18 09:16:22 2015
Return-Path: <pspacek@redhat.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDF1E1A8A63 for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 09:16:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.486
X-Spam-Level: 
X-Spam-Status: No, score=-7.486 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B5V-K5d_iSbd for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 09:16:14 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20B901A8A27 for <ldapext@ietf.org>; Wed, 18 Nov 2015 09:16:14 -0800 (PST)
Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id 9ECF4C0BB2AA for <ldapext@ietf.org>; Wed, 18 Nov 2015 17:16:13 +0000 (UTC)
Received: from pspacek.brq.redhat.com (unused [10.34.128.7] (may be forged)) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id tAIHGBIv023271 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <ldapext@ietf.org>; Wed, 18 Nov 2015 12:16:13 -0500
To: ldapext@ietf.org
References: <556EAE47.10406@redhat.com> <55913519.3040302@redhat.com> <559138C2.6060904@highlandsun.com> <559D4274.2000400@redhat.com>
From: Petr Spacek <pspacek@redhat.com>
Organization: Red Hat
Message-ID: <564CB25B.9020702@redhat.com>
Date: Wed, 18 Nov 2015 18:16:11 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <559D4274.2000400@redhat.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/8Ou3bx4bEunZRdAWMLAZjEX-7ZM>
Subject: Re: [ldapext] Content Synchronization Operation + Transactions
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2015 17:16:21 -0000

On 8.7.2015 17:32, Petr Spacek wrote:
> On 29.6.2015 14:23, Howard Chu wrote:
>> Petr Spacek wrote:
>>> On 3.6.2015 09:35, Petr Spacek wrote:
>>>> Hello,
>>>>
>>>> it seems to me that LDAP Transactions (RFC 5805) are not perfectly integrated
>>>> into Content Synchronization Operation (RFC 4533).
>>>>
>>>> Mainly the client has no idea what changes were part of single transaction. As
>>>> a result, client cannot replicate transactions reliably, especially when
>>>> connection drops in the middle of persist phase of Content Synchronization
>>>> Operation.
>>>>
>>>> Also some clients could use the information where LDAP transaction
>>>> started/ended for application-level transactions (if the application uses the
>>>> data in real-time) or possibly some optimizations (if some application-level
>>>> work needs to be done after each group of updates).
>>>>
>>>> I'm going to sketch -00 draft which will attempt to address this, probably by
>>>> adding new messages to indicate where transaction started and ended.
>>>> Naturally, this makes sense only for persist phase.
>>>
>>> The 00 version of the draft is now available. I would really appreciate any
>>> feedback!
>>>
>>> Particularly, I'm not very sure that "transaction identifier" in "End
>>> Transaction Notification Message" is the best idea.
>>
>> Assuming a unique transaction identifier per transaction, I see no reason you
>> couldn't allow interleaved transactions during persist stage. (Well, you would
>> need to send the txnID along with every message, so that may be excessive
>> overhead.) In OpenLDAP transactions would not be interleaved at execution time
>> anyway so perhaps it's a non-issue.
> 
> Main reason for using extra messages as transaction boundaries was ease of
> implementation on the client side. It can be quite awful to deal with multiple
> concurrent transactions on the application level. The assumption here is that
> transaction commit should be quite quick so serialization should not add a big
> performance penalty (SyncRepl serializes all changes anyway).

After LDAPCon I decided to wipe out transaction identifiers from the draft, so
transaction boundaries are marked by empty Start & End Transaction
Notification Messages.

This would be enough for making SyncRepl useful with transactions in
applications I care about. I will think about writing separate draft for
'ignore own writes', but today I think that it belongs to a separate document.


> Main motivation why tnxID was exposed to SyncRepl users was ability to detect
> own writes. Maybe it is better to hide tnxID completely, use empty Start/End
> Transation Notification messages, and define another control for 'ignore own
> writes when doing SyncRepl'.
> 
> What do you think? I'm not familiar with OpenLDAP internals, so I do not know
> how hard it is to implement 'ignore own writes' on server side. I assume that
> 'own write' = 'write done by the same BIND DN' but this can be tricky when it
> comes to proxying ...
> 
>> On a slightly related note, I intend to submit an extension to RFC5805 adding
>> a Prepare Transaction request. This would enable 2 phase commit, allowing us
>> to support transactions spanning multiple DSAs. With OpenLDAP's back-ldap,
>> back-meta, back-relay, and glue, the capability is sorely needed.
> 
> Good idea!
> 
> Would it be appropriate & possible to clarify what level of 'isolation' is
> assumed in RFC5805, possibly in the same draft? I guess that the
> under-specification will be more visible with 2 phase commit.
> 
> I think that this property is very important and its under-specification can
> cause incompatibilities if other servers decide to implement different levels
> of isolation.

Howard, are you going to clarify isolation level in the new drafts related to
transactions? I think that it would be really useful.

Thank you for your time!

Petr Spacek



-------- Forwarded Message --------
Subject: New Version Notification for
draft-spacek-ldapext-syncrepl-transaction-01.txt
Date: Wed, 18 Nov 2015 09:02:37 -0800
From: internet-drafts@ietf.org
To: Petr Spacek <pspacek@redhat.com>


A new version of I-D, draft-spacek-ldapext-syncrepl-transaction-01.txt
has been successfully submitted by Petr Spacek and posted to the
IETF repository.

Name:		draft-spacek-ldapext-syncrepl-transaction
Revision:	01
Title:		The Lightweight Directory Access Protocol (LDAP) Content
Synchronization Operation with Transactions
Document date:	2015-11-18
Group:		Individual Submission
Pages:		5
URL:
https://www.ietf.org/internet-drafts/draft-spacek-ldapext-syncrepl-transaction-01.txt
Status:
https://datatracker.ietf.org/doc/draft-spacek-ldapext-syncrepl-transaction/
Htmlized:
https://tools.ietf.org/html/draft-spacek-ldapext-syncrepl-transaction-01
Diff:
https://www.ietf.org/rfcdiff?url2=draft-spacek-ldapext-syncrepl-transaction-01

Abstract:
   This document specifies LDAP Control which extends the persist stage
   of the Content Synchronization Operation with information about LDAP
   transaction boundaries.  This information can be used to support
   application-level transactions or for application-level
   optimizations.


From nobody Wed Nov 18 09:34:38 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B1121A008E for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 09:34:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.001
X-Spam-Level: 
X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_40=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pJFRp0D2Ilmt for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 09:34:36 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.142]) by ietfa.amsl.com (Postfix) with ESMTP id 162B51A009D for <ldapext@ietf.org>; Wed, 18 Nov 2015 09:34:36 -0800 (PST)
Received: from host86-145-75-25.range86-145.btcentralplus.com ([86.145.75.25] helo=[192.168.1.67]) by mail5.atlas.pipex.net with esmtpa (Exim 4.71) (envelope-from <dbis@proseconsulting.co.uk>) id 1Zz6ct-0007vm-2n for ldapext@ietf.org; Wed, 18 Nov 2015 17:34:35 +0000
To: ldapext@ietf.org
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CA551.5040700@seantek.com>
From: Mark R Bannister <dbis@proseconsulting.co.uk>
Message-ID: <564CB6A7.8050908@proseconsulting.co.uk>
Date: Wed, 18 Nov 2015 17:34:31 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <564CA551.5040700@seantek.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/7PtH9yG-ETD4uTZl3MYBs48l-xM>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2015 17:34:37 -0000

On 18/11/2015 16:20, Sean Leonard wrote:
> On 11/18/2015 8:01 AM, Mark R Bannister wrote:
>> Hi,
>>
>> Further to the announcement of the new LDAPEXT charter at LDAPCon 
>> next week, please can I confirm that this will continue to be the 
>> mailing list for those discussions, or is a new mailing list being 
>> set-up?

Apologies, of course I meant "last week" not "next week".

>
> Yes, this will continue to be the mailing list for those discussions. 
> (Note that I am one participant, not even a charter author or 
> anything, and therefore only have one vote.)
>
> If you find out any information to the contrary, please post it to 
> this list so people can migrate elsewhere.

Hence the point of my question.

>
>>
>> When will the new charter be published for all to see and comment on?
>
> Haven't seen a thing.
>

Indeed, nor have I except for the brief discussion at LDAPCon.  I'm 
hoping that Ludovic or Howard will chime in.

Thanks,
Mark.


From nobody Wed Nov 18 12:48:06 2015
Return-Path: <michael@stroeder.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C3BC1B2E3C for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 12:48:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.487
X-Spam-Level: 
X-Spam-Status: No, score=-1.487 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qtZUPmBK2uHc for <ldapext@ietfa.amsl.com>; Wed, 18 Nov 2015 12:48:04 -0800 (PST)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 947D41B2E39 for <ldapext@ietf.org>; Wed, 18 Nov 2015 12:48:03 -0800 (PST)
Received: from srv4.stroeder.local (unknown [10.1.1.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.stroeder.local", Issuer "stroeder.com Server CA no. 2009-07" (verified OK)) by srv1.stroeder.com (Postfix) with ESMTPS id 852EA1CED7; Wed, 18 Nov 2015 20:48:00 +0000 (UTC)
Received: from nb2.stroeder.local (nb2.stroeder.local [10.1.1.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by srv4.stroeder.local (Postfix) with ESMTPS id 9AA281D410; Wed, 18 Nov 2015 20:47:57 +0000 (UTC)
To: Mark R Bannister <dbis@proseconsulting.co.uk>, ldapext <ldapext@ietf.org>
References: <564CA0C0.9010400@proseconsulting.co.uk>
From: =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>
X-Enigmail-Draft-Status: N1110
Message-ID: <564CE3FD.2030704@stroeder.com>
Date: Wed, 18 Nov 2015 21:47:57 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 SeaMonkey/2.39
MIME-Version: 1.0
In-Reply-To: <564CA0C0.9010400@proseconsulting.co.uk>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms030107010805080808030304"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/U7FNfaM3MAT-eGJ8SBtCXkrdvXY>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Nov 2015 20:48:06 -0000

This is a cryptographically signed message in MIME format.

--------------ms030107010805080808030304
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Mark R Bannister wrote:
> Further to the announcement of the new LDAPEXT charter at LDAPCon next =
week,
> please can I confirm that this will continue to be the mailing list for=
 those
> discussions, or is a new mailing list being set-up?

AFAICS up to now this will be *the* mailing list. I'd notify everybody he=
re if
that would have to be changed due to IETF preferences.

> When will the new charter be published for all to see and comment on?

Ludo....! ;-)

> Also, I understood from last week that RFC2307bis will be on the charte=
r,

Personally I see on charter simple solutions for common issues with
RFC2307bis, probably not a complete overhaul of RFC 2307.

> but DBIS (which is intended as its replacement) will not be, and the
> reasons given were:
>=20
> 1. There is only a single implementation.
> 2. It would take more than a year to complete.
>=20
> I'm a bit puzzled by (1), as I'm sure there are RFCs based on single
> implementations.

The term "RFC" is a bit blurry here. Starting here:

https://tools.ietf.org/html/rfc2418#section-7.3

   NOTE: The RFC series is a publication mechanism only and publication
   does not determine the IETF status of a document.  Status is
   determined through separate, explicit status labels assigned by the
   IESG on behalf of the IETF.  In other words, the reader is reminded
   that all Internet Standards are published as RFCs, but NOT all RFCs
   specify standards [4].

[4] Not All RFCs are Standards
    https://tools.ietf.org/html/rfc1796

Follow the references and you will also find many more docs describing th=
e
various tracks etc.

> However, clarification of that rule will be helpful.  It
> will be very hard to convince others to produce their own software
> implementations of DBIS if the reference implementation already availab=
le does
> the job, so I'm not sure I understand the purpose of the rule.

Simple explanation:
If you try to reach standards track two independent implementations are n=
eeded
to prove interoperability. Maybe some IETF experts around could give you =
more
detailed advice if needed.

Kurt already gave us some good advice regarding all this in the near past=
:

https://www.ietf.org/mail-archive/web/ldapext/current/msg01951.html

https://www.ietf.org/mail-archive/web/ldapext/current/msg02081.html

https://www.ietf.org/mail-archive/web/ldapext/current/msg02053.html

> Re (2), given the internet drafts are already written and the reference=

> implementation is complete and fully functional, I fail to see where th=
e
> evidence comes from that suggests it will take more than 1 year to comp=
lete?=20
> Can you please provide a breakdown of the steps that would be involved =
and why
> you think DBIS will take more than 1 year.

As I understand (2) it's generally hard to reach WG consensus on complex
documents. BTW: For this particular reason I will *not* try to add my =C6=
-DIR to
the list of WG work items. I would like to base it on overhaul of RFC 230=
7
details though.

> I am in conversation at the moment with others regarding further featur=
es that
> could be introduced into DBIS to make it even better, I hope to bring t=
hose
> conversations to this mailing list soon, as I would be very interested =
in
> soliciting more opinions on this subject.

If you want to DBIS within IETG WG this you have to find people willing t=
o

1. work on you on the documents as co-authors or at least reviewers

2. develop an independent DBIS implementation

Ciao, Michael.


--------------ms030107010805080808030304
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGYwggYqMIIFEqADAgECAgMPVg4wDQYJKoZIhvcNAQELBQAwgYwxCzAJBgNVBAYTAklMMRYw
FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp
Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJt
ZWRpYXRlIENsaWVudCBDQTAeFw0xNTA5MTAxNjMwMTdaFw0xNjA5MTAxNDA3NTBaMEQxHTAb
BgNVBAMMFG1pY2hhZWxAc3Ryb2VkZXIuY29tMSMwIQYJKoZIhvcNAQkBFhRtaWNoYWVsQHN0
cm9lZGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ3ulgRkFW/ozuAX
8HwDmP7ifGF09KbLcAEVVjS013fTAlEzq0TJVcMXx/57LqdWtelCi35YvCzXHURuZl6hpUlR
+yOR1sev9xP2NfEJHQKUfs435wN6xFmdg/LI+ydlJ/exc3XxZVnb994vtJOlQh1HgXJvCORp
9d359fQQMY5N71TiQs0rcn8SNUBLZYHom1U2g2oEHN/QFNf2noxfXdPxTWeeeR0EuhH1Yy/0
AE2JZk2VmFW6VZYjEPoXUOfRizEzSM6HjyG347RnFd5Zh5vquxN609Z2iSg1Txuvd/eLSSuu
9sxLfw/5Qq4Xd/vhNVTrvG8d4M9L54orRVdFwmsCAwEAAaOCAtowggLWMAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQU
ubJgGvVtleGfzm7tjClKT2uUcB4wHwYDVR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIw
HwYDVR0RBBgwFoEUbWljaGFlbEBzdHJvZWRlci5jb20wggFMBgNVHSAEggFDMIIBPzCCATsG
CysGAQQBgbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20v
cG9saWN5LnBkZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkwAwIBARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBhY2NvcmRpbmcg
dG8gdGhlIENsYXNzIDEgVmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0YXJ0Q29t
IENBIHBvbGljeSwgcmVsaWFuY2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2UgaW4g
Y29tcGxpYW5jZSBvZiB0aGUgcmVseWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8w
LTAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNzbC5jb20vY3J0dTEtY3JsLmNybDCBjgYIKwYB
BQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9j
bGFzczEvY2xpZW50L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9j
ZXJ0cy9zdWIuY2xhc3MxLmNsaWVudC5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5z
dGFydHNzbC5jb20vMA0GCSqGSIb3DQEBCwUAA4IBAQAv5aQr1I7ZAg4VJJtaPIi61v/v0v9j
Hs/Gl695n7shMeZx/H5F6EAwma0MWIWv1H9mtFcGhXiwr55SR1xMffy+C2Q5byyVcVKmrC+E
vP1Ke+VnJ6v/l3JV5zPQf38XdCvYQACHFIODnVmD5JI59TWzS5ReudfTf60kQeNoRTZH15el
8hORNOzkoGiV70Kuuw7pCOf0ncjshttJE3NetXa2f4rTsCC5UNrMqhF8Y6NALa3m/zzCK1+i
nvukFQPBU3+NFeNcrpp2nroEutsl3ftkcw6jAvQvTGEIw6AO13fgujtge+kxyoF2RuCSsEmT
jmyZ7QweLwfmuU70umVTM8HUMIIGNDCCBBygAwIBAgIBHjANBgkqhkiG9w0BAQUFADB9MQsw
CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkwHhcNMDcxMDI0MjEwMTU1WhcNMTcxMDI0MjEwMTU1WjCBjDELMAkG
A1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdp
dGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJp
bWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAxwmDzM4t2BqxKaQuE6uWvooyg4ymiEGWVUet1G8SD+rqvyNH4QrvnEIaFHxOhESi
p7vMz39ScLpNLbL1QpOlPW/tFIzNHS3qd2XRNYG5Sv9RcGE+T4qbLtsjjJbi6sL7Ls/f/X9f
tTyhxvxWkf8KW37iKrueKsxw2HqolH7GM6FX5UfNAwAu4ZifkpmZzU1slBhyWwaQPEPPZRsW
oTb7q8hmgv6Nv3Hg9rmA1/VPBIOQ6SKRkHXG0Hhmq1dOFoAFI411+a/9nWm5rcVjGcIWZ2v/
43Yksq60jExipA4l5uv9/+Hm33mbgmCszdj/Dthf13tgAv2O83hLJ0exTqfrlwIDAQABo4IB
rTCCAakwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFNy7ZKc
4NrLAVx8fpY1TvLUuFGCMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMGYGCCsG
AQUFBwEBBFowWDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMC0G
CCsGAQUFBzAChiFodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9zZnNjYS5jcnQwWwYDVR0fBFQw
UjAnoCWgI4YhaHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMCegJaAjhiFodHRw
Oi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwgYAGA1UdIAR5MHcwdQYLKwYBBAGBtTcB
AgEwZjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0
BggrBgEFBQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjAN
BgkqhkiG9w0BAQUFAAOCAgEACoMIfXirLAZcuGOMXq4cuSN3TaFx2H2GvD5VSy/6rV55BYHb
WNaPeQn3oBSU8KgQZn/Kck1JxbLpAxVCNtsxeW1R87ifhsYZ0qjdrA9anrW2MAWCtosmAOT4
OxK9QPoSjCMxM3HbkZCDJgnlE8jMopH21BbyAYr7b5EfGRQJNtgWcvqSXwKHnTutR08+Kkn0
KAkXCzeQNLeA5LlYUzFyM7kPAp8pIRMQ+seHunmyG642S2+y/qHEdMuGIwpfz3eDF1PdctL0
4qYK/zu+Qg1Bw0RwgigVZs/0c5HP2/e9DBHh7eSwtzYlk4AUr6yxLlcwSjOfOmKEQ/Q8tzh0
IFiNu9IPuTGAPBn4CPxD0+Ru8T2wg8/s43R/PT3kd1OEqOJUl7q+h+r6fpvU0Fzxd2tC8Ga6
fDEPme+1Nbi+03pVjuZQKbGwKJ66gEn06WqaxVZC+J8hh/jR0k9mST1iAZPNYulcNJ8tKmVt
jYsv0L1TSm2+NwON58tO+pIVzu3DWwSEXSf+qkDavQam+QtEOZxLBXI++aMUEapSn+k3Lxm4
8ZCYfAWLb/Xj7F5JQMbZvCexglAbYR0kIHqW5DnsYSdMD/IplJMojx0NBrxJ3fN9dvX2Y6BI
XRsF1du4qESm4/3CKuyUV7p9DW3mPlHTGLvYxnyKQy7VFBkoLINszBrOUeIxggPtMIID6QIB
ATCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsT
IlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29t
IENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgMPVg4wDQYJYIZIAWUD
BAIBBQCgggIpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE1
MTExODIwNDc1N1owLwYJKoZIhvcNAQkEMSIEIBKoOPBE+q3isSCh4w+Yjs0uXyVlSD7lqYqw
Fn8ZvsKTMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggq
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI
hvcNAwICASgwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUg
Q2xpZW50IENBAgMPVg4wgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEW
MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm
aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVy
bWVkaWF0ZSBDbGllbnQgQ0ECAw9WDjANBgkqhkiG9w0BAQEFAASCAQAc6W7i84FAfestARHT
FI9DKv9yTHD9nd04JJl1bxHBDoNiPJUJoSNJ7xny8az5yCqCoogw1l0RNAOXAr0Cn4G2k1hL
pQ+yWkP+Xto+EcuPBMb5Rcfrnju1ZvjTE7lfIHuiFWgX42HFiEtXNgLaOjGqdWTH7kTqp1Br
brzXgqOF41BjvoOBjHIqvR/ljv0d8uDj8GZmj0DeVVK6Y0vu1NCE+E/bUCv8Buu+SWdNQ0cY
jIl0m2eBCKVJwzOLai3fP1IyV/2qaVRI/yrPErie5ms1JCNhn5BjZqEJnCRM2OY2j+KivRk2
Yzeytu946YONC9Q0oizv+NzJJVPWektufLuCAAAAAAAA
--------------ms030107010805080808030304--


From nobody Thu Nov 19 04:25:45 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C843D1ACE4B for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 04:25:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 1.1
X-Spam-Level: *
X-Spam-Status: No, score=1.1 tagged_above=-999 required=5 tests=[BAYES_50=0.8,  MIME_8BIT_HEADER=0.3] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tlj1J4HBZoXY for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 04:25:42 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.142]) by ietfa.amsl.com (Postfix) with ESMTP id 48F501ACE2C for <ldapext@ietf.org>; Thu, 19 Nov 2015 04:25:42 -0800 (PST)
Received: from host86-145-75-25.range86-145.btcentralplus.com ([86.145.75.25] helo=[192.168.1.67]) by mail5.atlas.pipex.net with esmtpa (Exim 4.71) (envelope-from <dbis@proseconsulting.co.uk>) id 1ZzOHU-0002QN-7H; Thu, 19 Nov 2015 12:25:40 +0000
To: =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>, ldapext <ldapext@ietf.org>
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CE3FD.2030704@stroeder.com>
From: Mark R Bannister <dbis@proseconsulting.co.uk>
Message-ID: <564DBFBF.1040707@proseconsulting.co.uk>
Date: Thu, 19 Nov 2015 12:25:35 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <564CE3FD.2030704@stroeder.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/uvlsr9JQNZ6DDB2xaDc4yFaf1ts>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Nov 2015 12:25:45 -0000

On 18/11/2015 20:47, Michael Ströder wrote:
> Mark R Bannister wrote:
>> Further to the announcement of the new LDAPEXT charter at LDAPCon next week,
>> please can I confirm that this will continue to be the mailing list for those
>> discussions, or is a new mailing list being set-up?
> AFAICS up to now this will be *the* mailing list. I'd notify everybody here if
> that would have to be changed due to IETF preferences.

Good to hear it.

>
>> When will the new charter be published for all to see and comment on?
> Ludo....! ;-)

Time to wake up now, Ludo.  :-)


>> Also, I understood from last week that RFC2307bis will be on the charter,
> Personally I see on charter simple solutions for common issues with
> RFC2307bis, probably not a complete overhaul of RFC 2307.

I understood from previous exchanges with Kurt that RFC2307bis couldn't 
be standardised as it stands because it attempts to redefine attributes 
or classes from RFC2307, and you're not allowed to do that.  However, if 
people are already using RFC2307bis then you'll be in a catch-22 
situation, not being able to fix those problems without breaking it for 
existing users.  Ergo, RFC2307bis is dead in my opinion and will never 
be a standard.  So let's not cry over spilt milk, let's move on and 
embrace DBIS!! (Ok I'm stirring trouble here, and I'm biased, but I have 
a valid point).

>> but DBIS (which is intended as its replacement) will not be, and the
>> reasons given were:
>>
>> 1. There is only a single implementation.
>> 2. It would take more than a year to complete.
>>
>> I'm a bit puzzled by (1), as I'm sure there are RFCs based on single
>> implementations.
> The term "RFC" is a bit blurry here. Starting here:
>
> https://tools.ietf.org/html/rfc2418#section-7.3
>
>     NOTE: The RFC series is a publication mechanism only and publication
>     does not determine the IETF status of a document.  Status is
>     determined through separate, explicit status labels assigned by the
>     IESG on behalf of the IETF.  In other words, the reader is reminded
>     that all Internet Standards are published as RFCs, but NOT all RFCs
>     specify standards [4].
>
> [4] Not All RFCs are Standards
>      https://tools.ietf.org/html/rfc1796
>
> Follow the references and you will also find many more docs describing the
> various tracks etc.

Thanks Michael, I'm aware of all of the various tracks, but wouldn't 
want DBIS to fall into the same trap as RFC2307 did, being released as 
"experimental" but then being adopted everywhere, then being a real pain 
to fix up later.  I do want DBIS to become a proper ratified standard, 
and for that to happen, as Kurt said in his posting in December last 
year, I need the advice of an area director.  I approached Barry Leiba 
on this very subject in August, and it is partly because I approached 
him that the LDAP working group is being kick-started again.  But with 
DBIS off the agenda!

>
>> However, clarification of that rule will be helpful.  It
>> will be very hard to convince others to produce their own software
>> implementations of DBIS if the reference implementation already available does
>> the job, so I'm not sure I understand the purpose of the rule.
> Simple explanation:
> If you try to reach standards track two independent implementations are needed
> to prove interoperability. Maybe some IETF experts around could give you more
> detailed advice if needed.
>
> Kurt already gave us some good advice regarding all this in the near past:
>
> https://www.ietf.org/mail-archive/web/ldapext/current/msg01951.html
>
> https://www.ietf.org/mail-archive/web/ldapext/current/msg02081.html
>
> https://www.ietf.org/mail-archive/web/ldapext/current/msg02053.html

Indeed, and I followed Kurt's advice as given in msg02081 above, hence 
Barry's intervention.

>
>> Re (2), given the internet drafts are already written and the reference
>> implementation is complete and fully functional, I fail to see where the
>> evidence comes from that suggests it will take more than 1 year to complete?
>> Can you please provide a breakdown of the steps that would be involved and why
>> you think DBIS will take more than 1 year.
> As I understand (2) it's generally hard to reach WG consensus on complex
> documents. BTW: For this particular reason I will *not* try to add my Ć-DIR to
> the list of WG work items. I would like to base it on overhaul of RFC 2307
> details though.

Accepted, design by committee doesn't work.  But IETF working groups are 
not supposed to be designs by committee.  You speak of complex 
documents, but I don't see that the DBIS documents as complex, I think 
that is a rather subjective label.  Define complex?  I would be happy to 
make it less complex if people could suggest what they think is 
currently complicated about it.  If the IETF is unable to work with 
documents of the size of DBIS, then something is broken in the process I 
think, because each individual DBIS document is a lot smaller than 
RFC2307 (which I broke up to make it more manageable!).

>
>> I am in conversation at the moment with others regarding further features that
>> could be introduced into DBIS to make it even better, I hope to bring those
>> conversations to this mailing list soon, as I would be very interested in
>> soliciting more opinions on this subject.
> If you want to DBIS within IETG WG this you have to find people willing to
>
> 1. work on you on the documents as co-authors or at least reviewers
>
> 2. develop an independent DBIS implementation
>
> Ciao, Michael.
>

1. Is not hard to do, I think I could find people.
2. Is the bit I still don't understand.  Where is this rule written 
down?  I'm all for due process, and I can work with due process, esp. if 
it is well documented, but at the moment I feel that people are just 
shifting goal-posts to keep DBIS out.

Best regards,
Mark.


From nobody Thu Nov 19 04:45:44 2015
Return-Path: <chris.ridd@forgerock.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3CA11ACEAE for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 04:45:41 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level: 
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Z-itZDM5_FZ for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 04:45:40 -0800 (PST)
Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C8281ACEAB for <ldapext@ietf.org>; Thu, 19 Nov 2015 04:45:39 -0800 (PST)
Received: by wmdw130 with SMTP id w130so238776693wmd.0 for <ldapext@ietf.org>; Thu, 19 Nov 2015 04:45:38 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=forgerock.com; s=google; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=nJyuAl7CFphHSxrS3pLisRmyGFxIGk2OnEe78YvPhEw=; b=XPuOr12ybXVsOYB/8U4ZHl7ZCiEOoQ5HhPeG2mpcnXWw3N38l9vOR0tPKsyoiDZdlK GUhSSweQH07wgX9E3WgphBHwGNutRZKcndtlY3OiZ+CTSnb41qgRhz8p0tVPIDHTVt84 YWZRr4t+chdqpquqLY8uZgzXwxd0npb2HOjpM=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=nJyuAl7CFphHSxrS3pLisRmyGFxIGk2OnEe78YvPhEw=; b=kbPQSx1VrSlL+PL8Plc03VLUUtcmmO+z3Q57zVsFMyuwa9Fg15jeENL5JKIy+2kLVM yQ3Wn9EyMP3Hois16sCVK/kSEvoRA2Hh2kaHIjNzXLPvARcDnqWLdSI8plxGBolYpqNS 9032oAN9C3lBtmY/j/5fqVhI/I+an6601aNvv5p7m7lAto04U1LmsxFdP5l2HErpNEnf +NGxbrCDccVojwJjAiFf2HyXPKtbaYw+xkVjNUkw+2xNXK1wOtZ+1Hc+x6XINAD5wt1w MX3xOB7jCvRw81S3/fh9Fvnk0GR6dlSvL+3y/uap3YkVl8X7ZPlabdcQV7+tTdubUgww lzGQ==
X-Gm-Message-State: ALoCoQlVoRGegMBa0GAkHyim7VKIvUX/KgYNQfl8d15Jx1ic0RtH4rXDiV2LZ8gU0EIcrdzyXsYs
X-Received: by 10.28.89.129 with SMTP id n123mr2687259wmb.2.1447937137959; Thu, 19 Nov 2015 04:45:37 -0800 (PST)
Received: from ?IPv6:2001:470:1f09:8e7:31bf:60de:4dc0:8f52? ([2001:470:1f09:8e7:31bf:60de:4dc0:8f52]) by smtp.gmail.com with ESMTPSA id h7sm8171851wmf.0.2015.11.19.04.45.36 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 19 Nov 2015 04:45:36 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (1.0)
From: Chris Ridd <chris.ridd@forgerock.com>
X-Mailer: iPhone Mail (13B143)
In-Reply-To: <564DBFBF.1040707@proseconsulting.co.uk>
Date: Thu, 19 Nov 2015 12:45:36 +0000
Content-Transfer-Encoding: quoted-printable
Message-Id: <293C3EB8-6D1B-426B-A01E-57F425F8EA21@forgerock.com>
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CE3FD.2030704@stroeder.com> <564DBFBF.1040707@proseconsulting.co.uk>
To: Mark R Bannister <dbis@proseconsulting.co.uk>
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/amduD8l0HlLrukymWLTF4S-YxQA>
Cc: ldapext <ldapext@ietf.org>, =?utf-8?Q?Michael_Str=C3=B6der?= <michael@stroeder.com>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Nov 2015 12:45:41 -0000

On 19 Nov 2015, at 12:25, Mark R Bannister <dbis@proseconsulting.co.uk> wrot=
e:
>=20
> 2. Is the bit I still don't understand.  Where is this rule written down?

I believe this is currently described in RFC 6410.

Chris=


From nobody Thu Nov 19 05:14:52 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CC711AD0C7 for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 05:14:42 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.5
X-Spam-Level: 
X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_05=-0.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pdwllbv0EIUh for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 05:14:38 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.141]) by ietfa.amsl.com (Postfix) with ESMTP id 589421A6FDC for <ldapext@ietf.org>; Thu, 19 Nov 2015 05:14:38 -0800 (PST)
Received: from host86-148-222-229.range86-148.btcentralplus.com ([86.148.222.229] helo=[192.168.1.67]) by smtp06.mailcore.me with esmtpa (Exim 4.80.1) (envelope-from <dbis@proseconsulting.co.uk>) id 1ZzP2r-0003DZ-6Y; Thu, 19 Nov 2015 13:14:37 +0000
To: Chris Ridd <chris.ridd@forgerock.com>
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CE3FD.2030704@stroeder.com> <564DBFBF.1040707@proseconsulting.co.uk> <293C3EB8-6D1B-426B-A01E-57F425F8EA21@forgerock.com>
From: Mark R Bannister <dbis@proseconsulting.co.uk>
Message-ID: <564DCB37.1030408@proseconsulting.co.uk>
Date: Thu, 19 Nov 2015 13:14:31 +0000
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <293C3EB8-6D1B-426B-A01E-57F425F8EA21@forgerock.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/LPFOn1DtaBiaZgNb8OoQhFHw_cA>
Cc: ldapext <ldapext@ietf.org>, =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Nov 2015 13:14:42 -0000

On 19/11/2015 12:45, Chris Ridd wrote:
> On 19 Nov 2015, at 12:25, Mark R Bannister <dbis@proseconsulting.co.uk> wrote:
>> 2. Is the bit I still don't understand.  Where is this rule written down?
> I believe this is currently described in RFC 6410.
>
> Chris

Excellent, thanks Chris, that's exactly what I'm looking for.

Mark.


From nobody Thu Nov 19 13:57:34 2015
Return-Path: <michael@stroeder.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9ECB71B361B for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 13:57:32 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.487
X-Spam-Level: 
X-Spam-Status: No, score=-1.487 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0akzasZ3hGe0 for <ldapext@ietfa.amsl.com>; Thu, 19 Nov 2015 13:57:30 -0800 (PST)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4BC61B2EDD for <ldapext@ietf.org>; Thu, 19 Nov 2015 13:57:29 -0800 (PST)
Received: from srv4.stroeder.local (unknown [10.1.1.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.stroeder.local", Issuer "stroeder.com Server CA no. 2009-07" (verified OK)) by srv1.stroeder.com (Postfix) with ESMTPS id 01FA41CED7; Thu, 19 Nov 2015 21:57:26 +0000 (UTC)
Received: from nb2.stroeder.local (nb2.stroeder.local [10.1.1.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by srv4.stroeder.local (Postfix) with ESMTPS id 4469C1D410; Thu, 19 Nov 2015 21:57:24 +0000 (UTC)
To: Mark R Bannister <dbis@proseconsulting.co.uk>, ldapext <ldapext@ietf.org>
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CE3FD.2030704@stroeder.com> <564DBFBF.1040707@proseconsulting.co.uk>
From: =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>
X-Enigmail-Draft-Status: N1110
Message-ID: <564E45C3.7080708@stroeder.com>
Date: Thu, 19 Nov 2015 22:57:23 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 SeaMonkey/2.39
MIME-Version: 1.0
In-Reply-To: <564DBFBF.1040707@proseconsulting.co.uk>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms090206060002050303020103"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/TbzOmjJxYqWXjuz5DOYYc6kJXG4>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 19 Nov 2015 21:57:32 -0000

This is a cryptographically signed message in MIME format.

--------------ms090206060002050303020103
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Disclaimer: All my statements herein are solely my personal point of view=
=2E

Mark R Bannister wrote:
> I understood from previous exchanges with Kurt that RFC2307bis couldn't=
 be
> standardised as it stands because it attempts to redefine attributes or=

> classes from RFC2307, and you're not allowed to do that.

Yes, that's my understanding too.

> However, if people
> are already using RFC2307bis then you'll be in a catch-22 situation, no=
t being
> able to fix those problems without breaking it for existing users.  Erg=
o,
> RFC2307bis is dead in my opinion and will never be a standard.

RFC2307bis in this form seems dead. But my multi-SUP solution for 'posixG=
roup'
simply works backwards-compatible.

> Thanks Michael, I'm aware of all of the various tracks, but wouldn't wa=
nt DBIS
> to fall into the same trap as RFC2307 did, being released as "experimen=
tal"
> but then being adopted everywhere, then being a real pain to fix up lat=
er.

The problem with RFC 2307 is not that it's experimental.
The problem is that there are issues considered real flaws with 'posixGro=
up'
being one of them.

> Indeed, and I followed Kurt's advice as given in msg02081 above, hence =
Barry's
> intervention.

Understood.

>>> Re (2), given the internet drafts are already written and the referen=
ce
>>> implementation is complete and fully functional, I fail to see where =
the
>>> evidence comes from that suggests it will take more than 1 year to co=
mplete?
>>> Can you please provide a breakdown of the steps that would be involve=
d and why
>>> you think DBIS will take more than 1 year.
>> As I understand (2) it's generally hard to reach WG consensus on compl=
ex
>> documents. BTW: For this particular reason I will *not* try to add my =
=C6-DIR to
>> the list of WG work items. I would like to base it on overhaul of RFC =
2307
>> details though.
>=20
> Accepted, design by committee doesn't work.  But IETF working groups ar=
e not
> supposed to be designs by committee.  You speak of complex documents, b=
ut I
> don't see that the DBIS documents as complex, I think that is a rather
> subjective label.  Define complex?  I would be happy to make it less co=
mplex
> if people could suggest what they think is currently complicated about =
it.  If
> the IETF is unable to work with documents of the size of DBIS, then som=
ething
> is broken in the process I think, because each individual DBIS document=
 is a
> lot smaller than RFC2307 (which I broke up to make it more manageable!)=
=2E

It's not an issue with the IETF in general. You simply have to convince
potential ldapext WG co-workers to work and support DBIS in some way. The=
ir
support and contributions and WG consensus then would convince the IETF t=
o
accept it to be published on standard tracks.

Ciao, Michael.


--------------ms090206060002050303020103
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGYwggYqMIIFEqADAgECAgMPVg4wDQYJKoZIhvcNAQELBQAwgYwxCzAJBgNVBAYTAklMMRYw
FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp
Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJt
ZWRpYXRlIENsaWVudCBDQTAeFw0xNTA5MTAxNjMwMTdaFw0xNjA5MTAxNDA3NTBaMEQxHTAb
BgNVBAMMFG1pY2hhZWxAc3Ryb2VkZXIuY29tMSMwIQYJKoZIhvcNAQkBFhRtaWNoYWVsQHN0
cm9lZGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ3ulgRkFW/ozuAX
8HwDmP7ifGF09KbLcAEVVjS013fTAlEzq0TJVcMXx/57LqdWtelCi35YvCzXHURuZl6hpUlR
+yOR1sev9xP2NfEJHQKUfs435wN6xFmdg/LI+ydlJ/exc3XxZVnb994vtJOlQh1HgXJvCORp
9d359fQQMY5N71TiQs0rcn8SNUBLZYHom1U2g2oEHN/QFNf2noxfXdPxTWeeeR0EuhH1Yy/0
AE2JZk2VmFW6VZYjEPoXUOfRizEzSM6HjyG347RnFd5Zh5vquxN609Z2iSg1Txuvd/eLSSuu
9sxLfw/5Qq4Xd/vhNVTrvG8d4M9L54orRVdFwmsCAwEAAaOCAtowggLWMAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQU
ubJgGvVtleGfzm7tjClKT2uUcB4wHwYDVR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIw
HwYDVR0RBBgwFoEUbWljaGFlbEBzdHJvZWRlci5jb20wggFMBgNVHSAEggFDMIIBPzCCATsG
CysGAQQBgbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20v
cG9saWN5LnBkZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkwAwIBARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBhY2NvcmRpbmcg
dG8gdGhlIENsYXNzIDEgVmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0YXJ0Q29t
IENBIHBvbGljeSwgcmVsaWFuY2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2UgaW4g
Y29tcGxpYW5jZSBvZiB0aGUgcmVseWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8w
LTAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNzbC5jb20vY3J0dTEtY3JsLmNybDCBjgYIKwYB
BQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9j
bGFzczEvY2xpZW50L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9j
ZXJ0cy9zdWIuY2xhc3MxLmNsaWVudC5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5z
dGFydHNzbC5jb20vMA0GCSqGSIb3DQEBCwUAA4IBAQAv5aQr1I7ZAg4VJJtaPIi61v/v0v9j
Hs/Gl695n7shMeZx/H5F6EAwma0MWIWv1H9mtFcGhXiwr55SR1xMffy+C2Q5byyVcVKmrC+E
vP1Ke+VnJ6v/l3JV5zPQf38XdCvYQACHFIODnVmD5JI59TWzS5ReudfTf60kQeNoRTZH15el
8hORNOzkoGiV70Kuuw7pCOf0ncjshttJE3NetXa2f4rTsCC5UNrMqhF8Y6NALa3m/zzCK1+i
nvukFQPBU3+NFeNcrpp2nroEutsl3ftkcw6jAvQvTGEIw6AO13fgujtge+kxyoF2RuCSsEmT
jmyZ7QweLwfmuU70umVTM8HUMIIGNDCCBBygAwIBAgIBHjANBgkqhkiG9w0BAQUFADB9MQsw
CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkwHhcNMDcxMDI0MjEwMTU1WhcNMTcxMDI0MjEwMTU1WjCBjDELMAkG
A1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdp
dGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJp
bWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAxwmDzM4t2BqxKaQuE6uWvooyg4ymiEGWVUet1G8SD+rqvyNH4QrvnEIaFHxOhESi
p7vMz39ScLpNLbL1QpOlPW/tFIzNHS3qd2XRNYG5Sv9RcGE+T4qbLtsjjJbi6sL7Ls/f/X9f
tTyhxvxWkf8KW37iKrueKsxw2HqolH7GM6FX5UfNAwAu4ZifkpmZzU1slBhyWwaQPEPPZRsW
oTb7q8hmgv6Nv3Hg9rmA1/VPBIOQ6SKRkHXG0Hhmq1dOFoAFI411+a/9nWm5rcVjGcIWZ2v/
43Yksq60jExipA4l5uv9/+Hm33mbgmCszdj/Dthf13tgAv2O83hLJ0exTqfrlwIDAQABo4IB
rTCCAakwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFNy7ZKc
4NrLAVx8fpY1TvLUuFGCMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMGYGCCsG
AQUFBwEBBFowWDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMC0G
CCsGAQUFBzAChiFodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9zZnNjYS5jcnQwWwYDVR0fBFQw
UjAnoCWgI4YhaHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMCegJaAjhiFodHRw
Oi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwgYAGA1UdIAR5MHcwdQYLKwYBBAGBtTcB
AgEwZjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0
BggrBgEFBQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjAN
BgkqhkiG9w0BAQUFAAOCAgEACoMIfXirLAZcuGOMXq4cuSN3TaFx2H2GvD5VSy/6rV55BYHb
WNaPeQn3oBSU8KgQZn/Kck1JxbLpAxVCNtsxeW1R87ifhsYZ0qjdrA9anrW2MAWCtosmAOT4
OxK9QPoSjCMxM3HbkZCDJgnlE8jMopH21BbyAYr7b5EfGRQJNtgWcvqSXwKHnTutR08+Kkn0
KAkXCzeQNLeA5LlYUzFyM7kPAp8pIRMQ+seHunmyG642S2+y/qHEdMuGIwpfz3eDF1PdctL0
4qYK/zu+Qg1Bw0RwgigVZs/0c5HP2/e9DBHh7eSwtzYlk4AUr6yxLlcwSjOfOmKEQ/Q8tzh0
IFiNu9IPuTGAPBn4CPxD0+Ru8T2wg8/s43R/PT3kd1OEqOJUl7q+h+r6fpvU0Fzxd2tC8Ga6
fDEPme+1Nbi+03pVjuZQKbGwKJ66gEn06WqaxVZC+J8hh/jR0k9mST1iAZPNYulcNJ8tKmVt
jYsv0L1TSm2+NwON58tO+pIVzu3DWwSEXSf+qkDavQam+QtEOZxLBXI++aMUEapSn+k3Lxm4
8ZCYfAWLb/Xj7F5JQMbZvCexglAbYR0kIHqW5DnsYSdMD/IplJMojx0NBrxJ3fN9dvX2Y6BI
XRsF1du4qESm4/3CKuyUV7p9DW3mPlHTGLvYxnyKQy7VFBkoLINszBrOUeIxggPtMIID6QIB
ATCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsT
IlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29t
IENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgMPVg4wDQYJYIZIAWUD
BAIBBQCgggIpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE1
MTExOTIxNTcyM1owLwYJKoZIhvcNAQkEMSIEIJwDCcZbk/fqMseMRunrNIYw7YqbmjqEVJgH
iLp/7yZCMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggq
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI
hvcNAwICASgwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUg
Q2xpZW50IENBAgMPVg4wgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEW
MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm
aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVy
bWVkaWF0ZSBDbGllbnQgQ0ECAw9WDjANBgkqhkiG9w0BAQEFAASCAQBkw6KAaT9/FIzMiSEs
RRa0k8E0tJudwCumb4Hm1d8v07oLLvlQSo+f9gF55ndbrmN9w9vuXZyM6jE+A+VRmfps/CEe
pfMccdDTT8eIW6bSxXJi/fIHIWpPAyZCN8su1StC8I0rjIKAMqOjAfDextcseD4DEQs1whHJ
ZLswhcL7QjzZ2AAni8q6akY7k8m6cYK/slYXdMVECaDbX+E18vOIBLCjnQPt/+cob03sqOKS
BiHuRm7Sf86NDLOhZi2idLxw6Tvut1Ck13QilRQkiCmeRekhfmW/m9VNwHc7hCZRkbCBiyJ7
Bnqitojju8BdQEF6bGG3y1sfIkvNslubD0sgAAAAAAAA
--------------ms090206060002050303020103--


From nobody Fri Nov 20 09:26:34 2015
Return-Path: <barryleiba.mailing.lists@gmail.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E4041B39B4 for <ldapext@ietfa.amsl.com>; Fri, 20 Nov 2015 09:26:34 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.921
X-Spam-Level: 
X-Spam-Status: No, score=0.921 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, MIME_8BIT_HEADER=0.3, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VUole_c5oKDg for <ldapext@ietfa.amsl.com>; Fri, 20 Nov 2015 09:26:33 -0800 (PST)
Received: from mail-io0-x234.google.com (mail-io0-x234.google.com [IPv6:2607:f8b0:4001:c06::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 349BA1B39B2 for <ldapext@ietf.org>; Fri, 20 Nov 2015 09:26:33 -0800 (PST)
Received: by iouu10 with SMTP id u10so132498639iou.0 for <ldapext@ietf.org>; Fri, 20 Nov 2015 09:26:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=EaJSsTZUUekdSw0YEFKU558CpTDAb8OIIAop//mfhzI=; b=mh3HQU2Y1HiXmHauApFXU+woVaPQs8N3plH3oRySFfMyqZTylbcmiThI7NwSLoDUdj y0mUCgUsDkpNhuDRfNtB3Nr+YzxHh4pbksnZom7AlqgXHgsCTKFxUVruGK1nxDS0Nc7x gAG/RMVXVq9P1jSjFixryE3/PkketybG0YdTvePEfAWji22KwRS6fi1dUHnDG5kthdaO URsubYHS0dy+wgo24T9tzmqp+kWFlcIELL/zL8ZGpFlbsSM7RCnvxdD7Ydb2z7fDX0Yl WIKB50SCUEupwQIKQcFw239MKNmZQOyb13MaMuOk3UjMyzgy/OncytGrISxtfX39JSXz Xp+A==
MIME-Version: 1.0
X-Received: by 10.107.28.144 with SMTP id c138mr15184675ioc.15.1448040392611;  Fri, 20 Nov 2015 09:26:32 -0800 (PST)
Sender: barryleiba.mailing.lists@gmail.com
Received: by 10.107.181.202 with HTTP; Fri, 20 Nov 2015 09:26:32 -0800 (PST)
In-Reply-To: <564CE3FD.2030704@stroeder.com>
References: <564CA0C0.9010400@proseconsulting.co.uk> <564CE3FD.2030704@stroeder.com>
Date: Fri, 20 Nov 2015 12:26:32 -0500
X-Google-Sender-Auth: 1MzdfnSdU3WqgkqQv6c2OtZQIY4
Message-ID: <CAC4RtVAiQgSiCR720oBB99ju7Z6Ctk28ooM49GPjj=0Wf4ydYw@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
To: =?UTF-8?Q?Michael_Str=C3=B6der?= <michael@stroeder.com>
Content-Type: text/plain; charset=UTF-8
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/2y330cFtoBp4RU7YH06DDKxzRho>
Cc: ldapext <ldapext@ietf.org>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 20 Nov 2015 17:26:34 -0000

Here to clarify process:

>> 1. There is only a single implementation.
...
>> I'm a bit puzzled by (1), as I'm sure there are RFCs based on single
>> implementations.
...
> If you try to reach standards track two independent implementations are needed
> to prove interoperability. Maybe some IETF experts around could give you more
> detailed advice if needed.

Indeed, it's puzzling, because working groups and technical areas vary
with regard to what's important for that work or technical area.  RFC
6410 re-defines the "Standards Track" into two levels (down from
three): Proposed Standard and Internet Standard.  It's the latter for
which we need multiple deployed implementations to give evidence of
both utility and interoperability.  For Proposed Standard, there is no
requirement for that -- no requirement, in fact, for any
implementations at all.  It's a proposal.

That said, there's not much use in a proposed standard that no one
wants to implement, and we've found that the best proposals are those
that are developed in parallel with implementations, having the
development of the specification and the code feed back on each other,
with interoperability testing along the way.

See RFC 6982 for one proposal for documenting implementations as the
draft is developing.  I strongly support that mechanism.

> If you want to DBIS within IETG WG this you have to find people willing to
>
> 1. work on you on the documents as co-authors or at least reviewers
>
> 2. develop an independent DBIS implementation

Exactly.  (1) is, of course, necessary for any work to proceed in any
working group.  While (2) is not strictly necessary according to RFCs
2026 and 6410, it's reasonable for a working group (and/or an Area
Director) to push for that in order to demonstrate that people are
sufficiently interested in the work to move it toward implementation
and deployment, and to improve the specification as I mentioned above,
by finding the bugs, gaps, and implementation problems early, before
the spec is published.

I would not want to see artificial road blocks being put up against
anyone's proposal.  At the same time, in order to proceed with any
proposal there do need to be enough people interested in working on it
to get it done and to make it a useful product of the working group.

Barry, ART Area Director


From nobody Mon Nov 23 23:29:52 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB7A01A0204 for <ldapext@ietfa.amsl.com>; Mon, 23 Nov 2015 23:29:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 2.08
X-Spam-Level: **
X-Spam-Status: No, score=2.08 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, MIME_8BIT_HEADER=0.3] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Oz5zRk4Cyjs for <ldapext@ietfa.amsl.com>; Mon, 23 Nov 2015 23:29:48 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.141]) by ietfa.amsl.com (Postfix) with ESMTP id 305421A01A3 for <ldapext@ietf.org>; Mon, 23 Nov 2015 23:29:47 -0800 (PST)
Received: from dab-glb1-h-40-6.dab.02.net ([82.132.218.105] helo=[10.65.91.166]) by mail5.atlas.pipex.net with esmtpa (Exim 4.71) (envelope-from <dbis@proseconsulting.co.uk>) id 1a182q-0008Sf-I7; Tue, 24 Nov 2015 07:29:46 +0000
To: "=?utf-8?B?QmFycnkgTGVpYmE=?=" <barryleiba@computer.org>, "=?utf-8?B?TWljaGFlbCBTdHLDtmRlcg==?=" <michael@stroeder.com>
From: "=?utf-8?B?TWFyayBSIEJhbm5pc3Rlcg==?=" <dbis@proseconsulting.co.uk>
Date: Tue, 24 Nov 2015 07:29:44 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_0_1448350184254"
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Message-Id: <20151124072948.305421A01A3@ietfa.amsl.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/lJXAhULcDjmpzXcztFHxianKq7k>
Cc: ldapext <ldapext@ietf.org>
Subject: Re: [ldapext] =?utf-8?q?New_LDAPEXT_charter?=
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 07:29:51 -0000

------=_Part_0_1448350184254
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: base64
Content-Disposition: inline

VGhhbmtzIGZvciB0aGUgY2xhcmlmaWNhdGlvbiwgQmFycnkuPiBGb3IgUHJvcG9zZWQgU3RhbmRh
cmQsIHRoZXJlIGlzIG5vCj4gcmVxdWlyZW1lbnQgZm9yIHRoYXQgLS0gbm8gcmVxdWlyZW1lbnQs
IGluIGZhY3QsIGZvciBhbnkKPiBpbXBsZW1lbnRhdGlvbnMgYXQgYWxsLiAgSXQncyBhIHByb3Bv
c2FsLgpPaywgdGhlbiBJJ3ZlIHRydW1wZWQgdGhhdCwgYXMgSSBoYXZlIGFuIGltcGxlbWVudGF0
aW9uIGFscmVhZHkuCj4gPiBJZiB5b3Ugd2FudCB0byBEQklTIHdpdGhpbiBJRVRHIFdHIHRoaXMg
eW91IGhhdmUgdG8gZmluZCBwZW9wbGUgd2lsbGluZyB0bwo+ID4KPiA+IDEuIHdvcmsgb24geW91
IG9uIHRoZSBkb2N1bWVudHMgYXMgY28tYXV0aG9ycyBvciBhdCBsZWFzdCByZXZpZXdlcnMKPiA+
Cj4gPiAyLiBkZXZlbG9wIGFuIGluZGVwZW5kZW50IERCSVMgaW1wbGVtZW50YXRpb24KPiAKPiBF
eGFjdGx5LiAgKDEpIGlzLCBvZiBjb3Vyc2UsIG5lY2Vzc2FyeSBmb3IgYW55IHdvcmsgdG8gcHJv
Y2VlZCBpbiBhbnkKPiB3b3JraW5nIGdyb3VwLiAgV2hpbGUgKDIpIGlzIG5vdCBzdHJpY3RseSBu
ZWNlc3NhcnkgYWNjb3JkaW5nIHRvIFJGQ3MKMjAyNiBhbmQgNjQxMCwgaXQncyByZWFzb25hYmxl
IGZvciBhIHdvcmtpbmcgZ3JvdXAgKGFuZC9vciBhbiBBcmVhCj4gRGlyZWN0b3IpIHRvIHB1c2gg
Zm9yIHRoYXQKKDEpIHNob3VsZCBiZSBwb3NzaWJsZS4gIElzIHRoZXJlIGFuIG9mZmljaWFsIHBy
b2Nlc3MgYSByZXZpZXdlciBuZWVkcyB0byBmb2xsb3csIGluIG9yZGVyIHRvIGNvdW50IGFzIGEg
cmV2aWV3ZXIgZm9yIHRoaXMgcHVycG9zZT8KCigyKSBzZWVtcyB0byBjb250cmFkaWN0IHlvdXIg
Zmlyc3QgcG9pbnQgYWJvdXQgYSBQcm9wb3NlZCBTdGFuZGFyZCBub3QgZXZlbiBuZWVkaW5nIGFu
IGltcGxlbWVudGF0aW9uLiAgUGxlYXNlIGhlbHAgbWUgdW5kZXJzdGFuZCB0aGlzLiAgSXQgaXMg
ZWl0aGVyIHJlcXVpcmVkIG9yIG5vdCByZXF1aXJlZCBpbiBteSBjYXNlPwoKTWFueSB0aGFua3Ms
Ck1hcmsuCgotLS0tLSBSZXBseSBtZXNzYWdlIC0tLS0tCkZyb206ICJCYXJyeSBMZWliYSIgPGJh
cnJ5bGVpYmFAY29tcHV0ZXIub3JnPgpUbzogIk1pY2hhZWwgU3Ryw7ZkZXIiIDxtaWNoYWVsQHN0
cm9lZGVyLmNvbT4KQ2M6ICJNYXJrIFIgQmFubmlzdGVyIiA8ZGJpc0Bwcm9zZWNvbnN1bHRpbmcu
Y28udWs+LCAibGRhcGV4dCIgPGxkYXBleHRAaWV0Zi5vcmc+ClN1YmplY3Q6IFtsZGFwZXh0XSBO
ZXcgTERBUEVYVCBjaGFydGVyCkRhdGU6IEZyaSwgTm92IDIwLCAyMDE1IDE3OjI2CgpIZXJlIHRv
IGNsYXJpZnkgcHJvY2VzczoKCj4+IDEuIFRoZXJlIGlzIG9ubHkgYSBzaW5nbGUgaW1wbGVtZW50
YXRpb24uCi4uLi4KPj4gSSdtIGEgYml0IHB1enpsZWQgYnkgKDEpLCBhcyBJJ20gc3VyZSB0aGVy
ZSBhcmUgUkZDcyBiYXNlZCBvbiBzaW5nbGUKPj4gaW1wbGVtZW50YXRpb25zLgouLi4uCj4gSWYg
eW91IHRyeSB0byByZWFjaCBzdGFuZGFyZHMgdHJhY2sgdHdvIGluZGVwZW5kZW50IGltcGxlbWVu
dGF0aW9ucyBhcmUgbmVlZGVkCj4gdG8gcHJvdmUgaW50ZXJvcGVyYWJpbGl0eS4gTWF5YmUgc29t
ZSBJRVRGIGV4cGVydHMgYXJvdW5kIGNvdWxkIGdpdmUgeW91IG1vcmUKPiBkZXRhaWxlZCBhZHZp
Y2UgaWYgbmVlZGVkLgoKSW5kZWVkLCBpdCdzIHB1enpsaW5nLCBiZWNhdXNlIHdvcmtpbmcgZ3Jv
dXBzIGFuZCB0ZWNobmljYWwgYXJlYXMgdmFyeQp3aXRoIHJlZ2FyZCB0byB3aGF0J3MgaW1wb3J0
YW50IGZvciB0aGF0IHdvcmsgb3IgdGVjaG5pY2FsIGFyZWEuICBSRkMKNjQxMCByZS1kZWZpbmVz
IHRoZSAiU3RhbmRhcmRzIFRyYWNrIiBpbnRvIHR3byBsZXZlbHMgKGRvd24gZnJvbQp0aHJlZSk6
IFByb3Bvc2VkIFN0YW5kYXJkIGFuZCBJbnRlcm5ldCBTdGFuZGFyZC4gIEl0J3MgdGhlIGxhdHRl
ciBmb3IKd2hpY2ggd2UgbmVlZCBtdWx0aXBsZSBkZXBsb3llZCBpbXBsZW1lbnRhdGlvbnMgdG8g
Z2l2ZSBldmlkZW5jZSBvZgpib3RoIHV0aWxpdHkgYW5kIGludGVyb3BlcmFiaWxpdHkuICBGb3Ig
UHJvcG9zZWQgU3RhbmRhcmQsIHRoZXJlIGlzIG5vCnJlcXVpcmVtZW50IGZvciB0aGF0IC0tIG5v
IHJlcXVpcmVtZW50LCBpbiBmYWN0LCBmb3IgYW55CmltcGxlbWVudGF0aW9ucyBhdCBhbGwuICBJ
dCdzIGEgcHJvcG9zYWwuCgpUaGF0IHNhaWQsIHRoZXJlJ3Mgbm90IG11Y2ggdXNlIGluIGEgcHJv
cG9zZWQgc3RhbmRhcmQgdGhhdCBubyBvbmUKd2FudHMgdG8gaW1wbGVtZW50LCBhbmQgd2UndmUg
Zm91bmQgdGhhdCB0aGUgYmVzdCBwcm9wb3NhbHMgYXJlIHRob3NlCnRoYXQgYXJlIGRldmVsb3Bl
ZCBpbiBwYXJhbGxlbCB3aXRoIGltcGxlbWVudGF0aW9ucywgaGF2aW5nIHRoZQpkZXZlbG9wbWVu
dCBvZiB0aGUgc3BlY2lmaWNhdGlvbiBhbmQgdGhlIGNvZGUgZmVlZCBiYWNrIG9uIGVhY2ggb3Ro
ZXIsCndpdGggaW50ZXJvcGVyYWJpbGl0eSB0ZXN0aW5nIGFsb25nIHRoZSB3YXkuCgpTZWUgUkZD
IDY5ODIgZm9yIG9uZSBwcm9wb3NhbCBmb3IgZG9jdW1lbnRpbmcgaW1wbGVtZW50YXRpb25zIGFz
IHRoZQpkcmFmdCBpcyBkZXZlbG9waW5nLiAgSSBzdHJvbmdseSBzdXBwb3J0IHRoYXQgbWVjaGFu
aXNtLgoKPiBJZiB5b3Ugd2FudCB0byBEQklTIHdpdGhpbiBJRVRHIFdHIHRoaXMgeW91IGhhdmUg
dG8gZmluZCBwZW9wbGUgd2lsbGluZyB0bwo+Cj4gMS4gd29yayBvbiB5b3Ugb24gdGhlIGRvY3Vt
ZW50cyBhcyBjby1hdXRob3JzIG9yIGF0IGxlYXN0IHJldmlld2Vycwo+Cj4gMi4gZGV2ZWxvcCBh
biBpbmRlcGVuZGVudCBEQklTIGltcGxlbWVudGF0aW9uCgpFeGFjdGx5LiAgKDEpIGlzLCBvZiBj
b3Vyc2UsIG5lY2Vzc2FyeSBmb3IgYW55IHdvcmsgdG8gcHJvY2VlZCBpbiBhbnkKd29ya2luZyBn
cm91cC4gIFdoaWxlICgyKSBpcyBub3Qgc3RyaWN0bHkgbmVjZXNzYXJ5IGFjY29yZGluZyB0byBS
RkNzCjIwMjYgYW5kIDY0MTAsIGl0J3MgcmVhc29uYWJsZSBmb3IgYSB3b3JraW5nIGdyb3VwIChh
bmQvb3IgYW4gQXJlYQpEaXJlY3RvcikgdG8gcHVzaCBmb3IgdGhhdCBpbiBvcmRlciB0byBkZW1v
bnN0cmF0ZSB0aGF0IHBlb3BsZSBhcmUKc3VmZmljaWVudGx5IGludGVyZXN0ZWQgaW4gdGhlIHdv
cmsgdG8gbW92ZSBpdCB0b3dhcmQgaW1wbGVtZW50YXRpb24KYW5kIGRlcGxveW1lbnQsIGFuZCB0
byBpbXByb3ZlIHRoZSBzcGVjaWZpY2F0aW9uIGFzIEkgbWVudGlvbmVkIGFib3ZlLApieSBmaW5k
aW5nIHRoZSBidWdzLCBnYXBzLCBhbmQgaW1wbGVtZW50YXRpb24gcHJvYmxlbXMgZWFybHksIGJl
Zm9yZQp0aGUgc3BlYyBpcyBwdWJsaXNoZWQuCgpJIHdvdWxkIG5vdCB3YW50IHRvIHNlZSBhcnRp
ZmljaWFsIHJvYWQgYmxvY2tzIGJlaW5nIHB1dCB1cCBhZ2FpbnN0CmFueW9uZSdzIHByb3Bvc2Fs
LiAgQXQgdGhlIHNhbWUgdGltZSwgaW4gb3JkZXIgdG8gcHJvY2VlZCB3aXRoIGFueQpwcm9wb3Nh
bCB0aGVyZSBkbyBuZWVkIHRvIGJlIGVub3VnaCBwZW9wbGUgaW50ZXJlc3RlZCBpbiB3b3JraW5n
IG9uIGl0CnRvIGdldCBpdCBkb25lIGFuZCB0byBtYWtlIGl0IGEgdXNlZnVsIHByb2R1Y3Qgb2Yg
dGhlIHdvcmtpbmcgZ3JvdXAuCgpCYXJyeSwgQVJUIEFyZWEgRGlyZWN0b3I=


------=_Part_0_1448350184254
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: base64
Content-Disposition: inline

PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6ICdDYWxpYnJpJywgJ3NhbnMtc2VyaWYnOyI+VGhhbmtz
IGZvciB0aGUgY2xhcmlmaWNhdGlvbiwgQmFycnkuPGRpdj48ZGl2PjxwcmUgc3R5bGU9IndvcmQt
d3JhcDogYnJlYWstd29yZDsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+Jmd0OyBGb3IgUHJvcG9z
ZWQgU3RhbmRhcmQsIHRoZXJlIGlzIG5vCiZndDsgcmVxdWlyZW1lbnQgZm9yIHRoYXQgLS0gbm8g
cmVxdWlyZW1lbnQsIGluIGZhY3QsIGZvciBhbnkKJmd0OyBpbXBsZW1lbnRhdGlvbnMgYXQgYWxs
LiAgSXQncyBhIHByb3Bvc2FsLjwvcHJlPjwvZGl2PjxkaXY+T2ssIHRoZW4gSSd2ZSB0cnVtcGVk
IHRoYXQsIGFzIEkgaGF2ZSBhbiBpbXBsZW1lbnRhdGlvbiBhbHJlYWR5LjwvZGl2PjwvZGl2Pjxk
aXY+PHByZSBzdHlsZT0id29yZC13cmFwOiBicmVhay13b3JkOyB3aGl0ZS1zcGFjZTogcHJlLXdy
YXA7Ij4mZ3Q7ICZndDsgSWYgeW91IHdhbnQgdG8gREJJUyB3aXRoaW4gSUVURyBXRyB0aGlzIHlv
dSBoYXZlIHRvIGZpbmQgcGVvcGxlIHdpbGxpbmcgdG8KJmd0OyAmZ3Q7CiZndDsgJmd0OyAxLiB3
b3JrIG9uIHlvdSBvbiB0aGUgZG9jdW1lbnRzIGFzIGNvLWF1dGhvcnMgb3IgYXQgbGVhc3QgcmV2
aWV3ZXJzCiZndDsgJmd0OwomZ3Q7ICZndDsgMi4gZGV2ZWxvcCBhbiBpbmRlcGVuZGVudCBEQklT
IGltcGxlbWVudGF0aW9uCiZndDsgCiZndDsgRXhhY3RseS4gICgxKSBpcywgb2YgY291cnNlLCBu
ZWNlc3NhcnkgZm9yIGFueSB3b3JrIHRvIHByb2NlZWQgaW4gYW55CiZndDsgd29ya2luZyBncm91
cC4gIFdoaWxlICgyKSBpcyBub3Qgc3RyaWN0bHkgbmVjZXNzYXJ5IGFjY29yZGluZyB0byBSRkNz
CjIwMjYgYW5kIDY0MTAsIGl0J3MgcmVhc29uYWJsZSBmb3IgYSB3b3JraW5nIGdyb3VwIChhbmQv
b3IgYW4gQXJlYQomZ3Q7IERpcmVjdG9yKSB0byBwdXNoIGZvciB0aGF0PC9wcmU+PC9kaXY+PGRp
dj4oMSkgc2hvdWxkIGJlIHBvc3NpYmxlLiAmbmJzcDtJcyB0aGVyZSBhbiBvZmZpY2lhbCBwcm9j
ZXNzIGEgcmV2aWV3ZXIgbmVlZHMgdG8gZm9sbG93LCBpbiBvcmRlciB0byBjb3VudCBhcyBhIHJl
dmlld2VyIGZvciB0aGlzIHB1cnBvc2U/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj4oMikgc2Vl
bXMgdG8gY29udHJhZGljdCB5b3VyIGZpcnN0IHBvaW50IGFib3V0IGEgUHJvcG9zZWQgU3RhbmRh
cmQgbm90IGV2ZW4gbmVlZGluZyBhbiBpbXBsZW1lbnRhdGlvbi4gJm5ic3A7UGxlYXNlIGhlbHAg
bWUgdW5kZXJzdGFuZCB0aGlzLiAmbmJzcDtJdCBpcyBlaXRoZXIgcmVxdWlyZWQgb3Igbm90IHJl
cXVpcmVkIGluIG15IGNhc2U/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5NYW55IHRoYW5rcyw8
L2Rpdj48ZGl2Pk1hcmsuPC9kaXY+PGJyPjxkaXYgaWQ9Imh0Y19oZWFkZXIiPi0tLS0tIFJlcGx5
IG1lc3NhZ2UgLS0tLS08YnI+RnJvbTogJnF1b3Q7QmFycnkgTGVpYmEmcXVvdDsgJmx0O2JhcnJ5
bGVpYmFAY29tcHV0ZXIub3JnJmd0Ozxicj5UbzogJnF1b3Q7TWljaGFlbCBTdHLDtmRlciZxdW90
OyAmbHQ7bWljaGFlbEBzdHJvZWRlci5jb20mZ3Q7PGJyPkNjOiAmcXVvdDtNYXJrIFIgQmFubmlz
dGVyJnF1b3Q7ICZsdDtkYmlzQHByb3NlY29uc3VsdGluZy5jby51ayZndDssICZxdW90O2xkYXBl
eHQmcXVvdDsgJmx0O2xkYXBleHRAaWV0Zi5vcmcmZ3Q7PGJyPlN1YmplY3Q6IFtsZGFwZXh0XSBO
ZXcgTERBUEVYVCBjaGFydGVyPGJyPkRhdGU6IEZyaSwgTm92IDIwLCAyMDE1IDE3OjI2PC9kaXY+
PC9kaXY+PGJyPjxwcmUgc3R5bGU9IndvcmQtd3JhcDogYnJlYWstd29yZDsgd2hpdGUtc3BhY2U6
IHByZS13cmFwOyI+SGVyZSB0byBjbGFyaWZ5IHByb2Nlc3M6CgomZ3Q7Jmd0OyAxLiBUaGVyZSBp
cyBvbmx5IGEgc2luZ2xlIGltcGxlbWVudGF0aW9uLgouLi4uCiZndDsmZ3Q7IEknbSBhIGJpdCBw
dXp6bGVkIGJ5ICgxKSwgYXMgSSdtIHN1cmUgdGhlcmUgYXJlIFJGQ3MgYmFzZWQgb24gc2luZ2xl
CiZndDsmZ3Q7IGltcGxlbWVudGF0aW9ucy4KLi4uLgomZ3Q7IElmIHlvdSB0cnkgdG8gcmVhY2gg
c3RhbmRhcmRzIHRyYWNrIHR3byBpbmRlcGVuZGVudCBpbXBsZW1lbnRhdGlvbnMgYXJlIG5lZWRl
ZAomZ3Q7IHRvIHByb3ZlIGludGVyb3BlcmFiaWxpdHkuIE1heWJlIHNvbWUgSUVURiBleHBlcnRz
IGFyb3VuZCBjb3VsZCBnaXZlIHlvdSBtb3JlCiZndDsgZGV0YWlsZWQgYWR2aWNlIGlmIG5lZWRl
ZC4KCkluZGVlZCwgaXQncyBwdXp6bGluZywgYmVjYXVzZSB3b3JraW5nIGdyb3VwcyBhbmQgdGVj
aG5pY2FsIGFyZWFzIHZhcnkKd2l0aCByZWdhcmQgdG8gd2hhdCdzIGltcG9ydGFudCBmb3IgdGhh
dCB3b3JrIG9yIHRlY2huaWNhbCBhcmVhLiAgUkZDCjY0MTAgcmUtZGVmaW5lcyB0aGUgIlN0YW5k
YXJkcyBUcmFjayIgaW50byB0d28gbGV2ZWxzIChkb3duIGZyb20KdGhyZWUpOiBQcm9wb3NlZCBT
dGFuZGFyZCBhbmQgSW50ZXJuZXQgU3RhbmRhcmQuICBJdCdzIHRoZSBsYXR0ZXIgZm9yCndoaWNo
IHdlIG5lZWQgbXVsdGlwbGUgZGVwbG95ZWQgaW1wbGVtZW50YXRpb25zIHRvIGdpdmUgZXZpZGVu
Y2Ugb2YKYm90aCB1dGlsaXR5IGFuZCBpbnRlcm9wZXJhYmlsaXR5LiAgRm9yIFByb3Bvc2VkIFN0
YW5kYXJkLCB0aGVyZSBpcyBubwpyZXF1aXJlbWVudCBmb3IgdGhhdCAtLSBubyByZXF1aXJlbWVu
dCwgaW4gZmFjdCwgZm9yIGFueQppbXBsZW1lbnRhdGlvbnMgYXQgYWxsLiAgSXQncyBhIHByb3Bv
c2FsLgoKVGhhdCBzYWlkLCB0aGVyZSdzIG5vdCBtdWNoIHVzZSBpbiBhIHByb3Bvc2VkIHN0YW5k
YXJkIHRoYXQgbm8gb25lCndhbnRzIHRvIGltcGxlbWVudCwgYW5kIHdlJ3ZlIGZvdW5kIHRoYXQg
dGhlIGJlc3QgcHJvcG9zYWxzIGFyZSB0aG9zZQp0aGF0IGFyZSBkZXZlbG9wZWQgaW4gcGFyYWxs
ZWwgd2l0aCBpbXBsZW1lbnRhdGlvbnMsIGhhdmluZyB0aGUKZGV2ZWxvcG1lbnQgb2YgdGhlIHNw
ZWNpZmljYXRpb24gYW5kIHRoZSBjb2RlIGZlZWQgYmFjayBvbiBlYWNoIG90aGVyLAp3aXRoIGlu
dGVyb3BlcmFiaWxpdHkgdGVzdGluZyBhbG9uZyB0aGUgd2F5LgoKU2VlIFJGQyA2OTgyIGZvciBv
bmUgcHJvcG9zYWwgZm9yIGRvY3VtZW50aW5nIGltcGxlbWVudGF0aW9ucyBhcyB0aGUKZHJhZnQg
aXMgZGV2ZWxvcGluZy4gIEkgc3Ryb25nbHkgc3VwcG9ydCB0aGF0IG1lY2hhbmlzbS4KCiZndDsg
SWYgeW91IHdhbnQgdG8gREJJUyB3aXRoaW4gSUVURyBXRyB0aGlzIHlvdSBoYXZlIHRvIGZpbmQg
cGVvcGxlIHdpbGxpbmcgdG8KJmd0OwomZ3Q7IDEuIHdvcmsgb24geW91IG9uIHRoZSBkb2N1bWVu
dHMgYXMgY28tYXV0aG9ycyBvciBhdCBsZWFzdCByZXZpZXdlcnMKJmd0OwomZ3Q7IDIuIGRldmVs
b3AgYW4gaW5kZXBlbmRlbnQgREJJUyBpbXBsZW1lbnRhdGlvbgoKRXhhY3RseS4gICgxKSBpcywg
b2YgY291cnNlLCBuZWNlc3NhcnkgZm9yIGFueSB3b3JrIHRvIHByb2NlZWQgaW4gYW55Cndvcmtp
bmcgZ3JvdXAuICBXaGlsZSAoMikgaXMgbm90IHN0cmljdGx5IG5lY2Vzc2FyeSBhY2NvcmRpbmcg
dG8gUkZDcwoyMDI2IGFuZCA2NDEwLCBpdCdzIHJlYXNvbmFibGUgZm9yIGEgd29ya2luZyBncm91
cCAoYW5kL29yIGFuIEFyZWEKRGlyZWN0b3IpIHRvIHB1c2ggZm9yIHRoYXQgaW4gb3JkZXIgdG8g
ZGVtb25zdHJhdGUgdGhhdCBwZW9wbGUgYXJlCnN1ZmZpY2llbnRseSBpbnRlcmVzdGVkIGluIHRo
ZSB3b3JrIHRvIG1vdmUgaXQgdG93YXJkIGltcGxlbWVudGF0aW9uCmFuZCBkZXBsb3ltZW50LCBh
bmQgdG8gaW1wcm92ZSB0aGUgc3BlY2lmaWNhdGlvbiBhcyBJIG1lbnRpb25lZCBhYm92ZSwKYnkg
ZmluZGluZyB0aGUgYnVncywgZ2FwcywgYW5kIGltcGxlbWVudGF0aW9uIHByb2JsZW1zIGVhcmx5
LCBiZWZvcmUKdGhlIHNwZWMgaXMgcHVibGlzaGVkLgoKSSB3b3VsZCBub3Qgd2FudCB0byBzZWUg
YXJ0aWZpY2lhbCByb2FkIGJsb2NrcyBiZWluZyBwdXQgdXAgYWdhaW5zdAphbnlvbmUncyBwcm9w
b3NhbC4gIEF0IHRoZSBzYW1lIHRpbWUsIGluIG9yZGVyIHRvIHByb2NlZWQgd2l0aCBhbnkKcHJv
cG9zYWwgdGhlcmUgZG8gbmVlZCB0byBiZSBlbm91Z2ggcGVvcGxlIGludGVyZXN0ZWQgaW4gd29y
a2luZyBvbiBpdAp0byBnZXQgaXQgZG9uZSBhbmQgdG8gbWFrZSBpdCBhIHVzZWZ1bCBwcm9kdWN0
IG9mIHRoZSB3b3JraW5nIGdyb3VwLgoKQmFycnksIEFSVCBBcmVhIERpcmVjdG9yCjwvcHJlPg==


------=_Part_0_1448350184254--


From nobody Mon Nov 23 23:46:14 2015
Return-Path: <ludovic.poitou@gmail.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11C771A034F for <ldapext@ietfa.amsl.com>; Mon, 23 Nov 2015 23:46:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level: 
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqVSzI2Dq25c for <ldapext@ietfa.amsl.com>; Mon, 23 Nov 2015 23:46:10 -0800 (PST)
Received: from mail-wm0-x22e.google.com (mail-wm0-x22e.google.com [IPv6:2a00:1450:400c:c09::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C6631A034C for <ldapext@ietf.org>; Mon, 23 Nov 2015 23:46:10 -0800 (PST)
Received: by wmuu63 with SMTP id u63so84280217wmu.0 for <ldapext@ietf.org>; Mon, 23 Nov 2015 23:46:08 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=date:from:to:cc:message-id:subject:mime-version:content-type;  bh=68yaloODn2Q3ew4/DOgsBxyjU+CYvoEpnf6uO2SJCu0=; b=wOC/yt+FHI/6brPjwok653TMe7U9JOZGLlGqHmzqXeTAxSxIFNyObyAL67fWC6zqUe NVGygrvUclUyNdRLKU9XFvDVj5ffQEN5T2lDfeiuCdNj2QpXk23RA+rWgvYEYbG5iiHW dAMB4YEl6SIulmJCONXPPIrkurz4BbIZFiwnkHWBuNnIIVTARE4SeTQJ9ps2jCkt6s6Q FSGE84xJuepa6nFvlgdSPQqcWzzjfxSL+KfaIvXmiMFlJSr4Mrs/dmMaX91m7DFMKNkY AB1MAkXPx22d64PZglN4N9VCbWQm4Zxp80imQOYpAZP3L2em2uOiLymBYYPOw07zBtxc c7GA==
X-Received: by 10.28.51.135 with SMTP id z129mr20868366wmz.19.1448351168764; Mon, 23 Nov 2015 23:46:08 -0800 (PST)
Received: from lpm.local (cro38-1-82-236-150-92.fbx.proxad.net. [82.236.150.92]) by smtp.gmail.com with ESMTPSA id h67sm16714218wmf.17.2015.11.23.23.46.07 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 23 Nov 2015 23:46:07 -0800 (PST)
Date: Tue, 24 Nov 2015 08:46:06 +0100
From: Ludovic Poitou <ludovic.poitou@gmail.com>
To: Barry Leiba <barryleiba@computer.org>, Howard Chu <hyc@symas.com>
Message-ID: <etPan.565415be.6c215022.1b08@lpm.local>
X-Mailer: Airmail Beta (337)
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="565415be_19692e66_1b08"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/4fEh3Y9adJEl24r2F0598bnXrcg>
Cc: ldapext@ietf.org
Subject: [ldapext] Next LDAPExt draft charter...
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 07:46:13 -0000

--565415be_19692e66_1b08
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi Barry,

Please find below, the initial draft charter for a new working group at I=
ET=46 on the trail of the LDAPEXT working group (I don=E2=80=99t know if =
we can reuse the name of a closed WG).

As it=E2=80=99s been discussed on the ldapext mailing list already, the D=
BIS work has been left out of the draft charter, but possibly could be in=
tegrated within the first work element.

Please let us know if this draft charter is acceptable or needs to be ada=
pted to lead to the creation of the Working Group as soon as possible.

Kind regards,

Ludovic.
---

=C2=A0 =C2=A0Working Group Name:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 LDAP Extension (ldapext)

=C2=A0 =C2=A0IET=46 Area:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Applications and Real-Time (ART) Area=C2=A0

=C2=A0 =C2=A0Chair(s):
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Howard Chu (hyc=40symas.com)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Ludovic Poitou (ludovic.poitou=40gmail.com)

=C2=A0 =C2=A0Applications and Real-Time (ART) Area Director(s):
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Ben Campbell (ben=40nostrum.com)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Alissa Cooper (alissa=40cooperw.in)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Barry Leiba (barryleiba=40computer.org)

=C2=A0 =C2=A0Responsible Area Director:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Barry Leiba (barryleiba=40computer.org)

=C2=A0 =C2=A0Mailing Lists:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 General Discussion:ldapext=40ietf.org
=C2=A0 =C2=A0 =C2=A0 =C2=A0 To Subscribe: https://www.ietf.org/mailman/li=
stinfo/ldapext
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Archive: http://www.ietf.org/mail-archive/web=
/ldapext/

=C2=A0 =C2=A0Description of Working Group:

=C2=A0 =C2=A0The LDAPExt working group is charter to standardize extensio=
ns to
=C2=A0 =C2=A0LDAPv3 (R=46C 4510) standards.=C2=A0
=C2=A0 =C2=A0
=C2=A0 =C2=A0Some years ago, under the umbrella of a former ldapext WG or=
 as
=C2=A0 =C2=A0individual submissions, several extensions were proposed in =
the form of
=C2=A0 =C2=A0experimental R=46Cs and Internet Drafts. Although not finali=
zed, these
=C2=A0 =C2=A0specifications have been implemented by different vendors, w=
ith various
=C2=A0 =C2=A0interpretations leading to subtle interoperability issues.
=C2=A0 =C2=A0
=C2=A0 =C2=A0The working group will do the following:
=C2=A0 =C2=A0
=C2=A0 =C2=A0=46inish existing and implemented Internet Drafts and publis=
h them as
=C2=A0 =C2=A0Proposed Standards:
=C2=A0 =C2=A0
=C2=A0 =C2=A0* An Approach for Using LDAP as a Network Information Servic=
e (R=46C
=C2=A0 =C2=A0 =C2=A02307) was published as an Experimental R=46C. Soon af=
ter, revisions
=C2=A0 =C2=A0 =C2=A0appeared as draft-howard-rfc2307bis. The objective is=
 to conclude
=C2=A0 =C2=A0 =C2=A0this work in compliance with the IANA guide-lines, bu=
t preserving
=C2=A0 =C2=A0 =C2=A0interoperability with existing implementations.
=C2=A0
=C2=A0 =C2=A0* Define an information model and protocol to support Passwo=
rd Policy
=C2=A0 =C2=A0 =C2=A0for LDAP Directories, based on previous work describe=
d in
=C2=A0 =C2=A0 =C2=A0draft-behera-ldap-password-policy, considering the is=
sues raised in
=C2=A0 =C2=A0 =C2=A0draft-zeilenga-ldap-passwords but preserving interope=
rability with
=C2=A0 =C2=A0 =C2=A0existing implementations.
=C2=A0 =C2=A0 =C2=A0

=C2=A0 Define new extensions:
=C2=A0=C2=A0
=C2=A0 * An inetOrgPerson 2.0 schema to aggregate the needs and changes f=
or
=C2=A0 =C2=A0 entries representing Persons in a Directory.
=C2=A0 =C2=A0=C2=A0
=C2=A0 * Resolve issues with the representation of Groups in LDAP.
=C2=A0 =C2=A0 draft-findlay-ldap-groupofentries

=C2=A0 * Define utility schema descriptions widely used:
=C2=A0 =C2=A0 draft-stroeder-namedobject and draft-stroeder-mailboxrelate=
dobject
=C2=A0 =C2=A0=C2=A0
=C2=A0 * Define an informational document that describes the various
=C2=A0 =C2=A0 representations of hashed password values in the 'userPassw=
ord'
=C2=A0 =C2=A0 attribute. draft-stroeder-hashed-userpassword-values
=C2=A0 =C2=A0=C2=A0

=C2=A0 =C2=A0Goals and Milestones:

=C2=A0 =C2=A0Jan 2016 =C2=A0 =C2=A0Issue new versions of Groups in LDAP, =
Utility Schemas and
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hashed Password Va=
lues.
=C2=A0 =C2=A0Apr 2016 =C2=A0 =C2=A0Issue first revision Internet-Draft of=
 inetOrgPerson 2.0.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Issue first revisi=
on Internet-Draft on R=46C 2307 revision.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Issue first revisi=
on Internet-Draft on password policy.
=C2=A0 =C2=A0Jul 2016 =C2=A0 =C2=A0Submit Groups in LDAP, Utility Schemas=
 and
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hashed Password Va=
lues to IESG for publication as an R=46C.
=C2=A0 =C2=A0Oct 2016 =C2=A0 =C2=A0Submit inetOrgPerson 2.0 schema to IES=
G for publication as
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0an R=46C.
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Achieve consensus =
on R=46C 2307 Revision and Password Policy
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0for LDAP.
=C2=A0 =C2=A0Jan 2017 =C2=A0 =C2=A0Submit R=46C 2307 Revision and Passwor=
d Policy to IESG for
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0consideration as a=
 Proposed Standard.


--=C2=A0
Ludovic Poitou
http://ludopoitou.com
--565415be_19692e66_1b08
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html><head><style>body=7Bfont-family:Helvetica,Arial;font-size:13px=7D</=
style></head><body style=3D=22word-wrap: break-word; -webkit-nbsp-mode: s=
pace; -webkit-line-break: after-white-space;=22><div id=3D=22bloop=5Fcust=
omfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13px; color: r=
gba(0,0,0,1.0); margin: 0px; line-height: auto;=22>Hi Barry,</div><div id=
=3D=22bloop=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;font-s=
ize:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22><br>=
</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22font-family:Helvetica=
,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: =
auto;=22>Please find below, the initial draft charter for a new working g=
roup at IET=46 on the trail of the LDAPEXT working group (I don=E2=80=99t=
 know if we can reuse the name of a closed WG).</div><div id=3D=22bloop=5F=
customfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13px; colo=
r: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22><br></div><div id=3D=
=22bloop=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;font-size=
:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22>As it=E2=
=80=99s been discussed on the ldapext mailing list already, the DBIS work=
 has been left out of the draft charter, but possibly could be integrated=
 within the first work element.</div><div id=3D=22bloop=5Fcustomfont=22 s=
tyle=3D=22font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1=
.0); margin: 0px; line-height: auto;=22><br></div><div id=3D=22bloop=5Fcu=
stomfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13px; color:=
 rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22>Please let us know i=
f this draft charter is acceptable or needs to be adapted to lead to the =
creation of the Working Group as soon as possible.</div><div id=3D=22bloo=
p=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13px; =
color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22><br></div><div=
 id=3D=22bloop=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;fon=
t-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22>K=
ind regards,</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22font-fami=
ly:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; l=
ine-height: auto;=22><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=
=22font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); ma=
rgin: 0px; line-height: auto;=22>Ludovic.</div><div id=3D=22bloop=5Fcusto=
mfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13px; color: rg=
ba(0,0,0,1.0); margin: 0px; line-height: auto;=22>---</div><div id=3D=22b=
loop=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;font-size:13p=
x; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22><br></div><=
div id=3D=22bloop=5Fcustomfont=22 style=3D=22font-family:Helvetica,Arial;=
font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;=22=
><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nb=
sp;Working Group Name:</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22=
margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; LDAP Extension (ldapext)</div=
><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22><br></div>=
<div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbs=
p;IET=46 Area:</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin:=
 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Applications and Real-Time (ART) Are=
a&nbsp;</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22=
><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>=
&nbsp; &nbsp;Chair(s):</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22=
margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Howard Chu (hyc=40symas.com)<=
/div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp;=
 &nbsp; &nbsp; &nbsp; Ludovic Poitou (ludovic.poitou=40gmail.com)</div><d=
iv id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22><br></div><di=
v id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;A=
pplications and Real-Time (ART) Area Director(s):</div><div id=3D=22bloop=
=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; B=
en Campbell (ben=40nostrum.com)</div><div id=3D=22bloop=5Fcustomfont=22 s=
tyle=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Alissa Cooper (alis=
sa=40cooperw.in)</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margi=
n: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Barry Leiba (barryleiba=40computer=
.org)</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>=
<br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&=
nbsp; &nbsp;Responsible Area Director:</div><div id=3D=22bloop=5Fcustomfo=
nt=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Barry Leiba =
(barryleiba=40computer.org)</div><div id=3D=22bloop=5Fcustomfont=22 style=
=3D=22margin: 0px;=22><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=
=22margin: 0px;=22>&nbsp; &nbsp;Mailing Lists:</div><div id=3D=22bloop=5F=
customfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Gene=
ral Discussion:ldapext=40ietf.org</div><div id=3D=22bloop=5Fcustomfont=22=
 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; To Subscribe: htt=
ps://www.ietf.org/mailman/listinfo/ldapext</div><div id=3D=22bloop=5Fcust=
omfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; Archive:=
 http://www.ietf.org/mail-archive/web/ldapext/</div><div id=3D=22bloop=5F=
customfont=22 style=3D=22margin: 0px;=22><br></div><div id=3D=22bloop=5Fc=
ustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;Description of Worki=
ng Group:</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=
=22><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22=
>&nbsp; &nbsp;The LDAPExt working group is charter to standardize extensi=
ons to</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22=
>&nbsp; &nbsp;LDAPv3 (R=46C 4510) standards.&nbsp;</div><div id=3D=22bloo=
p=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;</div><div id=3D=
=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;Some yea=
rs ago, under the umbrella of a former ldapext WG or as</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;individual =
submissions, several extensions were proposed in the form of</div><div id=
=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;exper=
imental R=46Cs and Internet Drafts. Although not finalized, these</div><d=
iv id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;=
specifications have been implemented by different vendors, with various</=
div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; =
&nbsp;interpretations leading to subtle interoperability issues.</div><di=
v id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;<=
/div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp;=
 &nbsp;The working group will do the following:</div><div id=3D=22bloop=5F=
customfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;=46inish ex=
isting and implemented Internet Drafts and publish them as</div><div id=3D=
=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;Proposed=
 Standards:</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0p=
x;=22>&nbsp; &nbsp;</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22ma=
rgin: 0px;=22>&nbsp; &nbsp;* An Approach for Using LDAP as a Network Info=
rmation Service (R=46C</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22=
margin: 0px;=22>&nbsp; &nbsp; &nbsp;2307) was published as an Experimenta=
l R=46C. Soon after, revisions</div><div id=3D=22bloop=5Fcustomfont=22 st=
yle=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;appeared as draft-howard-rfc=
2307bis. The objective is to conclude</div><div id=3D=22bloop=5Fcustomfon=
t=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;this work in complian=
ce with the IANA guide-lines, but preserving</div><div id=3D=22bloop=5Fcu=
stomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;interoperabili=
ty with existing implementations.</div><div id=3D=22bloop=5Fcustomfont=22=
 style=3D=22margin: 0px;=22>&nbsp;</div><div id=3D=22bloop=5Fcustomfont=22=
 style=3D=22margin: 0px;=22>&nbsp; &nbsp;* Define an information model an=
d protocol to support Password Policy</div><div id=3D=22bloop=5Fcustomfon=
t=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;for LDAP Directories,=
 based on previous work described in</div><div id=3D=22bloop=5Fcustomfont=
=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;draft-behera-ldap-pass=
word-policy, considering the issues raised in</div><div id=3D=22bloop=5Fc=
ustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;draft-zeileng=
a-ldap-passwords but preserving interoperability with</div><div id=3D=22b=
loop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp;exist=
ing implementations.</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22m=
argin: 0px;=22>&nbsp; &nbsp; &nbsp;</div><div id=3D=22bloop=5Fcustomfont=22=
 style=3D=22margin: 0px;=22><br></div><div id=3D=22bloop=5Fcustomfont=22 =
style=3D=22margin: 0px;=22>&nbsp; Define new extensions:</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp;&nbsp;</div><div i=
d=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; * An inetO=
rgPerson 2.0 schema to aggregate the needs and changes for</div><div id=3D=
=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; entries=
 representing Persons in a Directory.</div><div id=3D=22bloop=5Fcustomfon=
t=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;&nbsp;</div><div id=3D=22blo=
op=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; * Resolve issues wit=
h the representation of Groups in LDAP.</div><div id=3D=22bloop=5Fcustomf=
ont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; draft-findlay-ldap-groupo=
fentries</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22=
><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>=
&nbsp; * Define utility schema descriptions widely used:</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; draft-stro=
eder-namedobject and draft-stroeder-mailboxrelatedobject</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;&nbsp;</div=
><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; * D=
efine an informational document that describes the various</div><div id=3D=
=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; represe=
ntations of hashed password values in the 'userPassword'</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; attribute.=
 draft-stroeder-hashed-userpassword-values</div><div id=3D=22bloop=5Fcust=
omfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;&nbsp;</div><div id=3D=22=
bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22><br></div><div id=3D=22b=
loop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;Goals and Mi=
lestones:</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=
=22><br></div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22=
>&nbsp; &nbsp;Jan 2016 &nbsp; &nbsp;Issue new versions of Groups in LDAP,=
 Utility Schemas and</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22m=
argin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Has=
hed Password Values.</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22m=
argin: 0px;=22>&nbsp; &nbsp;Apr 2016 &nbsp; &nbsp;Issue first revision In=
ternet-Draft of inetOrgPerson 2.0.</div><div id=3D=22bloop=5Fcustomfont=22=
 style=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nb=
sp; &nbsp;Issue first revision Internet-Draft on R=46C 2307 revision.</di=
v><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &n=
bsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Issue first revision Intern=
et-Draft on password policy.</div><div id=3D=22bloop=5Fcustomfont=22 styl=
e=3D=22margin: 0px;=22>&nbsp; &nbsp;Jul 2016 &nbsp; &nbsp;Submit Groups i=
n LDAP, Utility Schemas and</div><div id=3D=22bloop=5Fcustomfont=22 style=
=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &n=
bsp;Hashed Password Values to IESG for publication as an R=46C.</div><div=
 id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp;Oc=
t 2016 &nbsp; &nbsp;Submit inetOrgPerson 2.0 schema to IESG for publicati=
on as</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>=
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;an R=46C.</div><di=
v id=3D=22bloop=5Fcustomfont=22 style=3D=22margin: 0px;=22>&nbsp; &nbsp; =
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Achieve consensus on R=46C 2307 =
Revision and Password Policy</div><div id=3D=22bloop=5Fcustomfont=22 styl=
e=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &=
nbsp;for LDAP.</div><div id=3D=22bloop=5Fcustomfont=22 style=3D=22margin:=
 0px;=22>&nbsp; &nbsp;Jan 2017 &nbsp; &nbsp;Submit R=46C 2307 Revision an=
d Password Policy to IESG for</div><div id=3D=22bloop=5Fcustomfont=22 sty=
le=3D=22margin: 0px;=22>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =
&nbsp;consideration as a Proposed Standard.</div><div><br></div></div><br=
><div id=3D=22bloop=5Fsign=5F1448350560129244928=22 class=3D=22bloop=5Fsi=
gn=22><div style=3D=22font-family:helvetica,arial;font-size:13px=22>--&nb=
sp;<br>Ludovic Poitou<br><a href=3D=22http://ludopoitou.com=22>http://lud=
opoitou.com</a></div></div></body></html>
--565415be_19692e66_1b08--


From nobody Tue Nov 24 06:49:41 2015
Return-Path: <michael@stroeder.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E1B31A86F1 for <ldapext@ietfa.amsl.com>; Tue, 24 Nov 2015 06:49:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.988
X-Spam-Level: 
X-Spam-Status: No, score=-0.988 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YFQAFS47AYkr for <ldapext@ietfa.amsl.com>; Tue, 24 Nov 2015 06:49:37 -0800 (PST)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B07871A86E3 for <ldapext@ietf.org>; Tue, 24 Nov 2015 06:49:36 -0800 (PST)
Received: from srv4.stroeder.local (unknown [10.1.1.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.stroeder.local", Issuer "stroeder.com Server CA no. 2009-07" (verified OK)) by srv1.stroeder.com (Postfix) with ESMTPS id 9A51C1CF58 for <ldapext@ietf.org>; Tue, 24 Nov 2015 14:49:33 +0000 (UTC)
Received: from nb2.stroeder.local (nb2.stroeder.local [10.1.1.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by srv4.stroeder.local (Postfix) with ESMTPS id 5B3A71CF97 for <ldapext@ietf.org>; Tue, 24 Nov 2015 14:49:31 +0000 (UTC)
To: ldapext@ietf.org
From: =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>
X-Enigmail-Draft-Status: N1110
Message-ID: <565478FA.6050502@stroeder.com>
Date: Tue, 24 Nov 2015 15:49:30 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 SeaMonkey/2.39
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms040805000309040308090608"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/6jvnpESh0zbT7AFURCKWYsySKPc>
Subject: [ldapext] OATH-LDAP as ldapext WG item?
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 14:49:40 -0000

This is a cryptographically signed message in MIME format.

--------------ms040805000309040308090608
Content-Type: multipart/mixed;
 boundary="------------010209070103020706050908"

This is a multi-part message in MIME format.
--------------010209070103020706050908
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

HI!

Anyone here interested in co-authoring an I-D describing OATH-LDAP (prese=
nted
at LDAPcon 2015)?

Is there general interest to add this as ldapext WG item?

I have a schema for HOTP/TOTP (see attachment) and a reference implementa=
tion
for HOTP and some thoughts on operational considerations. TOTP schema mig=
ht
need some small work and I have to adapt the implementation.

Ciao, Michael.

--------------010209070103020706050908
Content-Type: text/plain; charset=UTF-8;
 name="oath-ldap.schema"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="oath-ldap.schema"

IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIFNjaGVtYSBmb3IgT0FUSC1MREFQCiMgJFJldmlz
aW9uOiAxLjQgJAojCiMgQXV0aG9yOiBNaWNoYWVsIFN0csO2ZGVyIDxtaWNoYWVsQHN0cm9l
ZGVyLmNvbT4KIwojIFRoaXMgc2NoZW1hIGlzIG1lYW50IHRvIGJlIHVzZWQgYWxvbmcgd2l0
aCBub3JtYWwgcGFzc3dvcmQgYXV0aGVudGljYXRpb24KIyB0aGVyZWZvcmUgaXQgZG9lcyBu
b3QgcmVwbGFjZSAndXNlclBhc3N3b3JkJyBhdHRyaWJ1dGUgdmFsdWVzLgojCiMgICAgICAr
LS0tLS0tLS0rCiMgICAgICB8IHBlcnNvbiB8PC0tLS0tLS0tLS0tKwojICAgICAgKy0tLS0t
LS0tKyAgICAgICAgICAgIHwKIyAgICAgICAgICBeICAgICAgICAgICAgKy0tLS0rLS0tLS0r
CiMgICAgICAgICAgfCAgICAgICAgICAgIHwgYWNjb3VudCAgfAojICAgICAgICAgIHwgICAg
ICAgICAgICArLS0rLS0tLSstLSsKIyAgICArLS0tLS0rLS0tLS0rICAgICAgICAgfCAgICB8
CiMgICAgfCBvYXRoVG9rZW4gfDwtLS0tLS0tLSsgICAgfAojICAgICstLS0tLSstLS0tLSsg
ICAgICAgICAgICAgIHwKIyAgICAgICAgICB8ICAgICAgICAgICAgICAgICAgICB8CiMgICAg
ICAgICAgViAgICAgICAgICAgICAgICAgICAgVgojICAgICstLS0tLSstLS0tLS0rICAgICAr
LS0tLS0tLS0tLS0rCiMgICAgfCBvYXRoUGFyYW1zIHwgICAgIHwgcHdkUG9saWN5IHwKIyAg
ICArLS0tLS0tLS0tLS0tKyAgICAgKy0tLS0tLS0tLS0tKwojCiMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
IyMjIyMKCiMgT0lEIGFyYyBmb3IgT0FUSCAoUkZDIDQyMjYgYW5kIFJGQyA2MjM4KSBiZW5l
YXRoIHN0cm9lZGVyLWNvbS1wdWItbGRhcAojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KCm9iamVjdGlk
ZW50aWZpZXIgb2F0aC1sZGFwIDEuMy42LjEuNC4xLjU0MjcuMS4zODkuNDIyNgpvYmplY3Rp
ZGVudGlmaWVyIG9hdGgtbGRhcC1hdCBvYXRoLWxkYXA6NApvYmplY3RpZGVudGlmaWVyIG9h
dGgtbGRhcC1vYyBvYXRoLWxkYXA6NgoKI35+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fgojIEdlbmVy
YWwKI35+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fgoKIyBBdHRyaWJ1dGUgdHlwZXMKIy0tLS0tLS0t
LS0tLS0tLS0KCmF0dHJpYnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6MQogIE5BTUUgJ29hdGhT
ZWNyZXQnCiAgREVTQyAnT0FUSC1MREFQOiBTaGFyZWQgU2VjcmV0JwogIFgtT1JJR0lOICdP
QVRILUxEQVAnCiAgU0lOR0xFLVZBTFVFCiAgRVFVQUxJVFkgb2N0ZXRTdHJpbmdNYXRjaAog
IFNVQlNUUiBvY3RldFN0cmluZ1N1YnN0cmluZ3NNYXRjaAogIFNZTlRBWCAxLjMuNi4xLjQu
MS4xNDY2LjExNS4xMjEuMS40MHsyNTZ9ICkKCmF0dHJpYnV0ZXR5cGUgKCBvYXRoLWxkYXAt
YXQ6MgogIE5BTUUgJ29hdGhUb2tlblNlcmlhbE51bWJlcicKICBERVNDICdPQVRILUxEQVA6
IFByb3ByaWV0YXJ5IGhhcmR3YXJlIHRva2VuIHNlcmlhbCBudW1iZXIgYXNzaWduZWQgYnkg
dmVuZG9yJwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lOR0xFLVZBTFVFCiAgU1VQIHNl
cmlhbE51bWJlciApCgojIHNlZSBzcGVjIGF0IGh0dHA6Ly9vcGVuYXV0aGVudGljYXRpb24u
b3JnL3NwZWNpZmljYXRpb24vdG9rZW5TcGVjcwphdHRyaWJ1dGV0eXBlICggb2F0aC1sZGFw
LWF0OjMKICBOQU1FICdvYXRoVG9rZW5JZGVudGlmaWVyJwogIERFU0MgJ09BVEgtTERBUDog
R2xvYmFsbHkgdW5pcXVlIE9BVEggdG9rZW4gaWRlbnRpZmllcicKICBYLU9SSUdJTiAnT0FU
SC1MREFQJwogIFNJTkdMRS1WQUxVRQogIFNVUCB1bmlxdWVJZGVudGlmaWVyICkKCmF0dHJp
YnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6NAogIE5BTUUgJ29hdGhQYXJhbXNFbnRyeScKICBE
RVNDICdPQVRILUxEQVA6IEROIHBvaW50aW5nIHRvIE9BVEggcGFyYW1ldGVyL3BvbGljeSBv
YmplY3QnCiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAgZGlz
dGluZ3Vpc2hlZE5hbWUgKQoKYXR0cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDo1CiAgTkFN
RSAnb2F0aE9UUExlbmd0aCcKICBERVNDICdPQVRILUxEQVA6IExlbmd0aCBvZiBPVFAgKG51
bWJlciBvZiBkaWdpdHMpJwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lOR0xFLVZBTFVF
CiAgRVFVQUxJVFkgaW50ZWdlck1hdGNoCiAgT1JERVJJTkcgaW50ZWdlck9yZGVyaW5nTWF0
Y2gKICBTWU5UQVggMS4zLjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMjcgKQoKYXR0cmlidXRl
dHlwZSAoIG9hdGgtbGRhcC1hdDo2CiAgTkFNRSAnb2F0aEhNQUNBbGdvcml0aG0nCiAgREVT
QyAnT0FUSC1MREFQOiBITUFDIGFsZ29yaXRobSB1c2VkIGZvciBnZW5lcmF0aW5nIE9UUCB2
YWx1ZXMnCiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBFUVVBTElU
WSBvYmplY3RJZGVudGlmaWVyTWF0Y2gKICBTWU5UQVggMS4zLjYuMS40LjEuMTQ2Ni4xMTUu
MTIxLjEuMzggKQoKYXR0cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDo3CiAgTkFNRSAnb2F0
aFRpbWVzdGFtcCcKICBERVNDICdPQVRILUxEQVA6IFRpbWVzdGFtcCAobm90IGRpcmVjdGx5
IHVzZWQpLicKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1WQUxVRQogIEVRVUFM
SVRZIGdlbmVyYWxpemVkVGltZU1hdGNoCiAgT1JERVJJTkcgZ2VuZXJhbGl6ZWRUaW1lT3Jk
ZXJpbmdNYXRjaAogIFNZTlRBWCAxLjMuNi4xLjQuMS4xNDY2LjExNS4xMjEuMS4yNCApCgph
dHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjcuMQogIE5BTUUgJ29hdGhMYXN0RmFpbHVy
ZScKICBERVNDICdPQVRILUxEQVA6IFRpbWVzdGFtcCBvZiBsYXN0IGZhaWxlZCBPQVRIIHZh
bGlkYXRpb24nCiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAg
b2F0aFRpbWVzdGFtcCApCgphdHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjcuMgogIE5B
TUUgJ29hdGhMYXN0TG9naW4nCiAgREVTQyAnT0FUSC1MREFQOiBUaW1lc3RhbXAgb2YgbGFz
dCBzdWNjZXNzZnVsIE9BVEggdmFsaWRhdGlvbicKICBYLU9SSUdJTiAnT0FUSC1MREFQJwog
IFNJTkdMRS1WQUxVRQogIFNVUCBvYXRoVGltZXN0YW1wICkKCmF0dHJpYnV0ZXR5cGUgKCBv
YXRoLWxkYXAtYXQ6Ny4zCiAgTkFNRSAnb2F0aFNlY3JldFRpbWUnCiAgREVTQyAnT0FUSC1M
REFQOiBUaW1lc3RhbXAgb2YgZ2VuZXJhdGlvbiBvZiBvYXRoU2VjcmV0IGF0dHJpYnV0ZS4n
CiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAgb2F0aFRpbWVz
dGFtcCApCgphdHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjgKICBOQU1FICdvYXRoU2Vj
cmV0TWF4QWdlJwogIERFU0MgJ09BVEgtTERBUDogVGltZSBpbiBzZWNvbmRzIGZvciB3aGlj
aCB0aGUgc2hhcmVkIHNlY3JldCAob2F0aFNlY3JldCkgd2lsbCBiZSB2YWxpZCBmcm9tIG9h
dGhTZWNyZXRUaW1lIHZhbHVlLicKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1W
QUxVRQogIEVRVUFMSVRZIGludGVnZXJNYXRjaAogIE9SREVSSU5HIGludGVnZXJPcmRlcmlu
Z01hdGNoCiAgU1lOVEFYIDEuMy42LjEuNC4xLjE0NjYuMTE1LjEyMS4xLjI3ICkKCmF0dHJp
YnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6MTEKICBOQU1FICdvYXRoU2VjcmV0TGVuZ3RoJwog
IERFU0MgJ09BVEgtTERBUDogTGVuZ3RoIG9mIHBsYWluLXRleHQgc2hhcmVkIHNlY3JldCAo
bnVtYmVyIG9mIGJ5dGVzKScKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1WQUxV
RQogIEVRVUFMSVRZIGludGVnZXJNYXRjaAogIE9SREVSSU5HIGludGVnZXJPcmRlcmluZ01h
dGNoCiAgU1lOVEFYIDEuMy42LjEuNC4xLjE0NjYuMTE1LjEyMS4xLjI3ICkKCmF0dHJpYnV0
ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6OQogIE5BTUUgJ29hdGhUb2tlbicKICBERVNDICdPQVRI
LUxEQVA6IEROIHBvaW50aW5nIHRvIE9BVEggdG9rZW4gb2JqZWN0JwogIFgtT1JJR0lOICdP
QVRILUxEQVAnCiAgU0lOR0xFLVZBTFVFCiAgU1VQIGRpc3Rpbmd1aXNoZWROYW1lICkKCmF0
dHJpYnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6MTAKICBOQU1FICdvYXRoQ291bnRlcicKICBE
RVNDICdPQVRILUxEQVA6IENvdW50ZXIgZm9yIE9BVEggZGF0YSAobm90IGRpcmVjdGx5IHVz
ZWQpJwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lOR0xFLVZBTFVFCiAgRVFVQUxJVFkg
aW50ZWdlck1hdGNoCiAgT1JERVJJTkcgaW50ZWdlck9yZGVyaW5nTWF0Y2gKICBTWU5UQVgg
MS4zLjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMjcgKQoKYXR0cmlidXRldHlwZSAoIG9hdGgt
bGRhcC1hdDoxMC4xCiAgTkFNRSAnb2F0aEZhaWx1cmVDb3VudCcKICBERVNDICdPQVRILUxE
QVA6IE9BVEggZmFpbHVyZSBjb3VudGVyJwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lO
R0xFLVZBTFVFCiAgU1VQIG9hdGhDb3VudGVyICkKCmF0dHJpYnV0ZXR5cGUgKCBvYXRoLWxk
YXAtYXQ6MTAuNwogIE5BTUUgJ29hdGhNYXhVc2FnZUNvdW50JwogIERFU0MgJ09BVEgtTERB
UDogTWF4aW11bSBudW1iZXIgb2YgdGltZXMgYSB0b2tlbiBjYW4gYmUgdXNlZCcKICBYLU9S
SUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1WQUxVRQogIFNVUCBvYXRoQ291bnRlciApCgph
dHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjEwLjUKICBOQU1FICdvYXRoVGhyb3R0bGVM
aW1pdCcKICBERVNDICdPQVRILUxEQVA6IEZhaWx1cmUgdGhyb3R0bGUgbGltaXQnCiAgWC1P
UklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAgb2F0aENvdW50ZXIgKQoK
IyBPYmplY3QgY2xhc3NlcwojLS0tLS0tLS0tLS0tLS0tCgpvYmplY3RjbGFzcyAoIG9hdGgt
bGRhcC1vYzoxCiAgTkFNRSAnb2F0aFVzZXInCiAgREVTQyAnT0FUSC1MREFQOiBVc2VyIE9i
amVjdCcKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIEFCU1RSQUNUICkKCiMgVGhpcyBvYmpl
Y3QgY2xhc3MgaXMgdXNlZCB0byBzcGVjaWZ5IGdlbmVyYWwgT0FUSCBwb2xpY3kgcGFyYW1l
dGVycwpvYmplY3RjbGFzcyAoIG9hdGgtbGRhcC1vYzoyCiAgTkFNRSAnb2F0aFBhcmFtcycK
ICBERVNDICdPQVRILUxEQVA6IFBhcmFtZXRlciBvYmplY3QnCiAgWC1PUklHSU4gJ09BVEgt
TERBUCcKICBBQlNUUkFDVAogIE1VU1QgKCBvYXRoT1RQTGVuZ3RoICQgb2F0aEhNQUNBbGdv
cml0aG0gKQogIE1BWSAoIG9hdGhTZWNyZXRNYXhBZ2UgJCBvYXRoU2VjcmV0TGVuZ3RoICQK
ICAgICAgICBvYXRoTWF4VXNhZ2VDb3VudCAkIG9hdGhUaHJvdHRsZUxpbWl0ICkgKQoKb2Jq
ZWN0Y2xhc3MgKCBvYXRoLWxkYXAtb2M6MwogIE5BTUUgJ29hdGhUb2tlbicKICBERVNDICdP
QVRILUxEQVA6IFVzZXIgT2JqZWN0JwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgQUJTVFJB
Q1QKICBNQVkgKCBvYXRoU2VjcmV0ICQgb2F0aFNlY3JldFRpbWUgJAogICAgICAgIG9hdGhM
YXN0TG9naW4gJCBvYXRoRmFpbHVyZUNvdW50ICQgb2F0aExhc3RGYWlsdXJlICQKICAgICAg
ICBvYXRoVG9rZW5TZXJpYWxOdW1iZXIgJCBvYXRoVG9rZW5JZGVudGlmaWVyICkgKQoKI35+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fgojIEhPVFAgKHNlZSBSRkMgNDIyNikKI35+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fgoKIyBBdHRyaWJ1dGUgdHlwZXMKIy0tLS0tLS0tLS0tLS0tLS0KCmF0dHJp
YnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6OS4xCiAgTkFNRSAnb2F0aEhPVFBUb2tlbicKICBE
RVNDICdPQVRILUxEQVA6IEROIHBvaW50aW5nIHRvIE9BVEgvSE9UUCB0b2tlbiBvYmplY3Qn
CiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAgb2F0aFRva2Vu
ICkKCmF0dHJpYnV0ZXR5cGUgKCBvYXRoLWxkYXAtYXQ6MTAuMgogIE5BTUUgJ29hdGhIT1RQ
Q291bnRlcicKICBERVNDICdPQVRILUxEQVA6IENvdW50ZXIgZm9yIEhPVFAnCiAgWC1PUklH
SU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFMVUUKICBTVVAgb2F0aENvdW50ZXIgKQoKYXR0
cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDoxMC4zCiAgTkFNRSAnb2F0aEhPVFBMb29rQWhl
YWQnCiAgREVTQyAnT0FUSC1MREFQOiBMb29rLWFoZWFkIHdpbmRvdyBmb3IgSE9UUCcKICBY
LU9SSUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1WQUxVRQogIFNVUCBvYXRoQ291bnRlciAp
CgphdHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjUuMQogIE5BTUUgJ29hdGhIT1RQUGFy
YW1zJwogIERFU0MgJ09BVEgtTERBUDogRE4gcG9pbnRpbmcgdG8gSE9UUCBwYXJhbWV0ZXIg
b2JqZWN0JwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lOR0xFLVZBTFVFCiAgU1VQIG9h
dGhQYXJhbXNFbnRyeSApCgphdHRyaWJ1dGV0eXBlICggb2F0aC1sZGFwLWF0OjUuMgogIE5B
TUUgJ29hdGhUT1RQUGFyYW1zJwogIERFU0MgJ09BVEgtTERBUDogRE4gcG9pbnRpbmcgdG8g
VE9UUCBwYXJhbWV0ZXIgb2JqZWN0JwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lOR0xF
LVZBTFVFCiAgU1VQIG9hdGhQYXJhbXNFbnRyeSApCgojIE9iamVjdCBjbGFzc2VzCiMtLS0t
LS0tLS0tLS0tLS0KCm9iamVjdGNsYXNzICggb2F0aC1sZGFwLW9jOjEuMQogIE5BTUUgJ29h
dGhIT1RQVXNlcicKICBERVNDICdPQVRILUxEQVA6IEhPVFAgdXNlciBvYmplY3QnCiAgWC1P
UklHSU4gJ09BVEgtTERBUCcKICBBVVhJTElBUlkKICBTVVAgb2F0aFVzZXIKICBNQVkgKCBv
YXRoSE9UUFRva2VuICkgKQoKb2JqZWN0Y2xhc3MgKCBvYXRoLWxkYXAtb2M6Mi4xCiAgTkFN
RSAnb2F0aEhPVFBQYXJhbXMnCiAgREVTQyAnT0FUSC1MREFQOiBIT1RQIHBhcmFtZXRlciBv
YmplY3QnCiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBBVVhJTElBUlkKICBTVVAgb2F0aFBh
cmFtcwogIE1VU1QgKCBvYXRoSE9UUExvb2tBaGVhZCApICkKCm9iamVjdGNsYXNzICggb2F0
aC1sZGFwLW9jOjMuMQogIE5BTUUgJ29hdGhIT1RQVG9rZW4nCiAgREVTQyAnT0FUSC1MREFQ
OiBIT1RQIHRva2VuIG9iamVjdCcKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIEFVWElMSUFS
WQogIFNVUCBvYXRoVG9rZW4KICBNQVkgKCBvYXRoSE9UUFBhcmFtcyAkIG9hdGhIT1RQQ291
bnRlciApICkKCgojfn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+CiMgVE9UUCAoc2VlIFJGQyA2MjM4
KQojfn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+
fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+CgojIEF0dHJpYnV0ZSB0eXBlcwojLS0tLS0tLS0t
LS0tLS0tLQoKYXR0cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDo5LjIKICBOQU1FICdvYXRo
VE9UUFRva2VuJwogIERFU0MgJ09BVEgtTERBUDogRE4gcG9pbnRpbmcgdG8gT0FUSC9UT1RQ
IHRva2VuIG9iamVjdCcKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIFNJTkdMRS1WQUxVRQog
IFNVUCBvYXRoVG9rZW4gKQoKYXR0cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDo0LjEKICBO
QU1FICdvYXRoVE9UUFRpbWVTdGVwUGVyaW9kJwogIERFU0MgJ09BVEgtTERBUDogVGltZSB3
aW5kb3cgZm9yIFRPVFAgKHNlY29uZHMpJwogIFgtT1JJR0lOICdPQVRILUxEQVAnCiAgU0lO
R0xFLVZBTFVFCiAgRVFVQUxJVFkgaW50ZWdlck1hdGNoCiAgT1JERVJJTkcgaW50ZWdlck9y
ZGVyaW5nTWF0Y2gKICBTWU5UQVggMS4zLjYuMS40LjEuMTQ2Ni4xMTUuMTIxLjEuMjcgKQoK
YXR0cmlidXRldHlwZSAoIG9hdGgtbGRhcC1hdDoxMC42CiAgTkFNRSAnb2F0aFRPVFBMYXN0
VGltZVN0ZXAnCiAgREVTQyAnT0FUSC1MREFQOiBMYXN0IHRpbWUgc3RlcCBzZWVuIGZvciBU
T1RQICh0aW1lL3BlcmlvZCknCiAgWC1PUklHSU4gJ09BVEgtTERBUCcKICBTSU5HTEUtVkFM
VUUKICBTVVAgb2F0aENvdW50ZXIgKQoKIyBPYmplY3QgY2xhc3NlcwojLS0tLS0tLS0tLS0t
LS0tCgpvYmplY3RjbGFzcyAoIG9hdGgtbGRhcC1vYzoxLjIKICBOQU1FICdvYXRoVE9UUFVz
ZXInCiAgREVTQyAnT0FUSC1MREFQOiBUT1RQIHVzZXIgb2JqZWN0JwogIFgtT1JJR0lOICdP
QVRILUxEQVAnCiAgQVVYSUxJQVJZCiAgU1VQIG9hdGhVc2VyCiAgTVVTVCAoIG9hdGhUT1RQ
VG9rZW4gKSApCgpvYmplY3RjbGFzcyAoIG9hdGgtbGRhcC1vYzoyLjIKICBOQU1FICdvYXRo
VE9UUFBhcmFtcycKICBERVNDICdPQVRILUxEQVA6IFRPVFAgcGFyYW1ldGVyIG9iamVjdCcK
ICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIEFVWElMSUFSWQogIFNVUCBvYXRoUGFyYW1zCiAg
TVVTVCAoIG9hdGhUT1RQVGltZVN0ZXBQZXJpb2QgKSApCgpvYmplY3RjbGFzcyAoIG9hdGgt
bGRhcC1vYzozLjIKICBOQU1FICdvYXRoVE9UUFRva2VuJwogIERFU0MgJ09BVEgtTERBUDog
VE9UUCB0b2tlbicKICBYLU9SSUdJTiAnT0FUSC1MREFQJwogIEFVWElMSUFSWQogIFNVUCBv
YXRoVG9rZW4KICBNQVkgKCBvYXRoVE9UUFBhcmFtcyAkIG9hdGhUT1RQTGFzdFRpbWVTdGVw
ICkgKQoK
--------------010209070103020706050908--

--------------ms040805000309040308090608
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGYwggYqMIIFEqADAgECAgMPVg4wDQYJKoZIhvcNAQELBQAwgYwxCzAJBgNVBAYTAklMMRYw
FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp
Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJt
ZWRpYXRlIENsaWVudCBDQTAeFw0xNTA5MTAxNjMwMTdaFw0xNjA5MTAxNDA3NTBaMEQxHTAb
BgNVBAMMFG1pY2hhZWxAc3Ryb2VkZXIuY29tMSMwIQYJKoZIhvcNAQkBFhRtaWNoYWVsQHN0
cm9lZGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ3ulgRkFW/ozuAX
8HwDmP7ifGF09KbLcAEVVjS013fTAlEzq0TJVcMXx/57LqdWtelCi35YvCzXHURuZl6hpUlR
+yOR1sev9xP2NfEJHQKUfs435wN6xFmdg/LI+ydlJ/exc3XxZVnb994vtJOlQh1HgXJvCORp
9d359fQQMY5N71TiQs0rcn8SNUBLZYHom1U2g2oEHN/QFNf2noxfXdPxTWeeeR0EuhH1Yy/0
AE2JZk2VmFW6VZYjEPoXUOfRizEzSM6HjyG347RnFd5Zh5vquxN609Z2iSg1Txuvd/eLSSuu
9sxLfw/5Qq4Xd/vhNVTrvG8d4M9L54orRVdFwmsCAwEAAaOCAtowggLWMAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQU
ubJgGvVtleGfzm7tjClKT2uUcB4wHwYDVR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIw
HwYDVR0RBBgwFoEUbWljaGFlbEBzdHJvZWRlci5jb20wggFMBgNVHSAEggFDMIIBPzCCATsG
CysGAQQBgbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20v
cG9saWN5LnBkZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkwAwIBARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBhY2NvcmRpbmcg
dG8gdGhlIENsYXNzIDEgVmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0YXJ0Q29t
IENBIHBvbGljeSwgcmVsaWFuY2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2UgaW4g
Y29tcGxpYW5jZSBvZiB0aGUgcmVseWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8w
LTAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNzbC5jb20vY3J0dTEtY3JsLmNybDCBjgYIKwYB
BQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9j
bGFzczEvY2xpZW50L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9j
ZXJ0cy9zdWIuY2xhc3MxLmNsaWVudC5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5z
dGFydHNzbC5jb20vMA0GCSqGSIb3DQEBCwUAA4IBAQAv5aQr1I7ZAg4VJJtaPIi61v/v0v9j
Hs/Gl695n7shMeZx/H5F6EAwma0MWIWv1H9mtFcGhXiwr55SR1xMffy+C2Q5byyVcVKmrC+E
vP1Ke+VnJ6v/l3JV5zPQf38XdCvYQACHFIODnVmD5JI59TWzS5ReudfTf60kQeNoRTZH15el
8hORNOzkoGiV70Kuuw7pCOf0ncjshttJE3NetXa2f4rTsCC5UNrMqhF8Y6NALa3m/zzCK1+i
nvukFQPBU3+NFeNcrpp2nroEutsl3ftkcw6jAvQvTGEIw6AO13fgujtge+kxyoF2RuCSsEmT
jmyZ7QweLwfmuU70umVTM8HUMIIGNDCCBBygAwIBAgIBHjANBgkqhkiG9w0BAQUFADB9MQsw
CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkwHhcNMDcxMDI0MjEwMTU1WhcNMTcxMDI0MjEwMTU1WjCBjDELMAkG
A1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdp
dGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJp
bWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAxwmDzM4t2BqxKaQuE6uWvooyg4ymiEGWVUet1G8SD+rqvyNH4QrvnEIaFHxOhESi
p7vMz39ScLpNLbL1QpOlPW/tFIzNHS3qd2XRNYG5Sv9RcGE+T4qbLtsjjJbi6sL7Ls/f/X9f
tTyhxvxWkf8KW37iKrueKsxw2HqolH7GM6FX5UfNAwAu4ZifkpmZzU1slBhyWwaQPEPPZRsW
oTb7q8hmgv6Nv3Hg9rmA1/VPBIOQ6SKRkHXG0Hhmq1dOFoAFI411+a/9nWm5rcVjGcIWZ2v/
43Yksq60jExipA4l5uv9/+Hm33mbgmCszdj/Dthf13tgAv2O83hLJ0exTqfrlwIDAQABo4IB
rTCCAakwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFNy7ZKc
4NrLAVx8fpY1TvLUuFGCMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMGYGCCsG
AQUFBwEBBFowWDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMC0G
CCsGAQUFBzAChiFodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9zZnNjYS5jcnQwWwYDVR0fBFQw
UjAnoCWgI4YhaHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMCegJaAjhiFodHRw
Oi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwgYAGA1UdIAR5MHcwdQYLKwYBBAGBtTcB
AgEwZjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0
BggrBgEFBQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjAN
BgkqhkiG9w0BAQUFAAOCAgEACoMIfXirLAZcuGOMXq4cuSN3TaFx2H2GvD5VSy/6rV55BYHb
WNaPeQn3oBSU8KgQZn/Kck1JxbLpAxVCNtsxeW1R87ifhsYZ0qjdrA9anrW2MAWCtosmAOT4
OxK9QPoSjCMxM3HbkZCDJgnlE8jMopH21BbyAYr7b5EfGRQJNtgWcvqSXwKHnTutR08+Kkn0
KAkXCzeQNLeA5LlYUzFyM7kPAp8pIRMQ+seHunmyG642S2+y/qHEdMuGIwpfz3eDF1PdctL0
4qYK/zu+Qg1Bw0RwgigVZs/0c5HP2/e9DBHh7eSwtzYlk4AUr6yxLlcwSjOfOmKEQ/Q8tzh0
IFiNu9IPuTGAPBn4CPxD0+Ru8T2wg8/s43R/PT3kd1OEqOJUl7q+h+r6fpvU0Fzxd2tC8Ga6
fDEPme+1Nbi+03pVjuZQKbGwKJ66gEn06WqaxVZC+J8hh/jR0k9mST1iAZPNYulcNJ8tKmVt
jYsv0L1TSm2+NwON58tO+pIVzu3DWwSEXSf+qkDavQam+QtEOZxLBXI++aMUEapSn+k3Lxm4
8ZCYfAWLb/Xj7F5JQMbZvCexglAbYR0kIHqW5DnsYSdMD/IplJMojx0NBrxJ3fN9dvX2Y6BI
XRsF1du4qESm4/3CKuyUV7p9DW3mPlHTGLvYxnyKQy7VFBkoLINszBrOUeIxggPtMIID6QIB
ATCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsT
IlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29t
IENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgMPVg4wDQYJYIZIAWUD
BAIBBQCgggIpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE1
MTEyNDE0NDkzMFowLwYJKoZIhvcNAQkEMSIEIAM1p5m37xw1vaQeYW500Vdp5XHAjgKQgAG0
RzhZsmJBMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggq
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI
hvcNAwICASgwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUg
Q2xpZW50IENBAgMPVg4wgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEW
MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm
aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVy
bWVkaWF0ZSBDbGllbnQgQ0ECAw9WDjANBgkqhkiG9w0BAQEFAASCAQBbXS/LSGrHamVDzW4A
nPCrC5sMACFXDMmEQETte63PssPH50nUM8K9wjrOfZGbmckUv/nHLaCn3dp51CYSQoxOJ/Kq
lWXE7kcofra7Pa/7lwu6wu5c9XoVJV4zMmi/P/FZ/dXL//syM2oUaLdWuTSkxpQGB79Xo0wJ
A85TsMxYiCw9GTancbeSEO+jA1ngS2lj1uAXA2s7qvpWWcWZwT1tW3gOBYxwOayLuwteF9Yq
9L1jxHmp7VfHSjdKd7Qgc69J416olRLikLLjt0TRrixRzDYLH1Kydaw6at3AsfB1Bj++DIdb
dIiaUJGSWmfNlZHBanORwLlbTOeC/d34LGfBAAAAAAAA
--------------ms040805000309040308090608--


From nobody Tue Nov 24 07:07:54 2015
Return-Path: <barryleiba@gmail.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB12F1A872D for <ldapext@ietfa.amsl.com>; Tue, 24 Nov 2015 07:07:53 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level: 
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yhu9XvaPZgAi for <ldapext@ietfa.amsl.com>; Tue, 24 Nov 2015 07:07:52 -0800 (PST)
Received: from mail-vk0-x22f.google.com (mail-vk0-x22f.google.com [IPv6:2607:f8b0:400c:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7CD541A8733 for <ldapext@ietf.org>; Tue, 24 Nov 2015 07:07:52 -0800 (PST)
Received: by vkha189 with SMTP id a189so13243095vkh.2 for <ldapext@ietf.org>; Tue, 24 Nov 2015 07:07:51 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=C7cJeeLIXMb72Dz3oZj05A8rOJY1X+WH85OnApWsQCU=; b=kAMy1fuxy6beowNMHgA7ddo6qtLYNpdWEW7ltcjR85mUb5klD/LggBRsNw8EAYanoo 0p1R7kKHJNBs1UxqLA+6L69jtv4RxOAASnOtDIHcpJdx402T3oLorZzqN5IUCYWIyKUQ /IhoUVeVHOgrx4xZr5H2SXE0JhHbuAP1OvzRfO3BCvOBnOEHIHL0EqymT0GKeC49DT7u 5hSqAGllUds0R0bbpH+i/zAuNXfcm65G3YgiQqsw59H22BHgFWyOi+/UHHYem2J9cViI DV9ffuKmIfph7MzlojprbVo6/r6LtFlsAYaOUe+y0fI8l4ZH1y1+MP4xnKf0fWdxWRLw FptQ==
MIME-Version: 1.0
X-Received: by 10.31.150.135 with SMTP id y129mr26502882vkd.156.1448377671510;  Tue, 24 Nov 2015 07:07:51 -0800 (PST)
Sender: barryleiba@gmail.com
Received: by 10.31.182.135 with HTTP; Tue, 24 Nov 2015 07:07:51 -0800 (PST)
In-Reply-To: <565411ea.6786c20a.9da4b.4e98SMTPIN_ADDED_MISSING@mx.google.com>
References: <565411ea.6786c20a.9da4b.4e98SMTPIN_ADDED_MISSING@mx.google.com>
Date: Tue, 24 Nov 2015 10:07:51 -0500
X-Google-Sender-Auth: ljKWC-pbssIh7P0GRoaO2zcnmRA
Message-ID: <CALaySJJC_XS6z8uXPUg2=X8bK0jXN_nAawTjXRnynEkPQvRGCw@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
To: Mark R Bannister <dbis@proseconsulting.co.uk>
Content-Type: text/plain; charset=UTF-8
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/YE1qF7Viy29ZhB62VXvYPR_wOi0>
Cc: ldapext <ldapext@ietf.org>
Subject: Re: [ldapext] New LDAPEXT charter
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 15:07:53 -0000

>> > If you want to DBIS within IETG WG this you have to find people willing
>> > to
>> >
>> > 1. work on you on the documents as co-authors or at least reviewers
>> >
>> > 2. develop an independent DBIS implementation
>>
>> Exactly.  (1) is, of course, necessary for any work to proceed in any
>> working group.  While (2) is not strictly necessary according to RFCs
> 2026 and 6410, it's reasonable for a working group (and/or an Area
>> Director) to push for that
>
> (1) should be possible.  Is there an official process a reviewer needs to
> follow, in order to count as a reviewer for this purpose?

No, people just need to participate in the working group discussions,
and part of that would be the discussions of the documents we're
talking about.

> (2) seems to contradict your first point about a Proposed Standard not even
> needing an implementation.  Please help me understand this.  It is either
> required or not required in my case?

There's no contradiction: there's no IETF rule that requires
implementations for PS.  That said we don't want to spend a lot of
time developing proposed standards that no one will deploy.  So it's
reasonable for a working group to decide, by its own consensus, that
it doesn't want to work on something unless the working group is
satisfied that there's a commitment to implement and deploy it.

Some working groups are willing to work on things speculatively, and
some aren't.  In some cases, we have whole topic areas -- routing
algorithms and congestion control mechanisms come to mind -- where the
working groups require proposals to be published as Experimental
first.  These aren't IETF rules, but are working group decisions of
how they'll do their work.

Barry


From nobody Wed Nov 25 04:58:18 2015
Return-Path: <dbis@proseconsulting.co.uk>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F19EE1A1B69 for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 04:58:17 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 3.08
X-Spam-Level: ***
X-Spam-Status: No, score=3.08 tagged_above=-999 required=5 tests=[BAYES_60=1.5, FROM_EXCESS_BASE64=0.979, HTML_MESSAGE=0.001, J_CHICKENPOX_71=0.6] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zBg-ylqgOIZp for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 04:58:16 -0800 (PST)
Received: from mailex.mailcore.me (mailex.mailcore.me [94.136.40.62]) by ietfa.amsl.com (Postfix) with ESMTP id 293C21B2C1A for <ldapext@ietf.org>; Wed, 25 Nov 2015 04:58:15 -0800 (PST)
Received: from [193.240.169.6] (helo=[192.168.85.43]) by mail11.atlas.pipex.net with esmtpa (Exim 4.71) (envelope-from <dbis@proseconsulting.co.uk>) id 1a1ZeI-0006W8-5O; Wed, 25 Nov 2015 12:58:14 +0000
To: "=?utf-8?B?QmFycnkgTGVpYmE=?=" <barryleiba@computer.org>
From: "=?utf-8?B?TWFyayBSIEJhbm5pc3Rlcg==?=" <dbis@proseconsulting.co.uk>
Date: Wed, 25 Nov 2015 12:58:14 +0000
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_0_1448456294123"
X-Mailcore-Auth: 12040446
X-Mailcore-Domain: 1286164
Message-Id: <20151125125816.293C21B2C1A@ietfa.amsl.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/N52nURmGM5ON8Hj7Ud--HggP1xA>
Cc: ldapext <ldapext@ietf.org>
Subject: Re: [ldapext] =?utf-8?q?New_LDAPEXT_charter?=
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Nov 2015 12:58:18 -0000

------=_Part_0_1448456294123
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: base64
Content-Disposition: inline

PiA+ICgxKSBzaG91bGQgYmUgcG9zc2libGUuICBJcyB0aGVyZSBhbiBvZmZpY2lhbCBwcm9jZXNz
IGEgcmV2aWV3ZXIgbmVlZHMgdG8KPiA+IGZvbGxvdywgaW4gb3JkZXIgdG8gY291bnQgYXMgYSBy
ZXZpZXdlciBmb3IgdGhpcyBwdXJwb3NlPwo+Cj4gTm8sIHBlb3BsZSBqdXN0IG5lZWQgdG8gcGFy
dGljaXBhdGUgaW4gdGhlIHdvcmtpbmcgZ3JvdXAgZGlzY3Vzc2lvbnMsCj4gYW5kIHBhcnQgb2Yg
dGhhdCB3b3VsZCBiZSB0aGUgZGlzY3Vzc2lvbnMgb2YgdGhlIGRvY3VtZW50cyB3ZSdyZQo+IHRh
bGtpbmcgYWJvdXQuT2sgdGhhbmtzIEJhcnJ5LiAgVGhlbiBpZiBJIGNhbiBmaW5kIHNvbWUgcGVv
cGxlIHdobyBjYW4gbm9taW5hdGUgdGhlbXNlbHZlcyBhcyByZXZpZXdlcnMgb24gdGhpcyBtYWls
aW5nIGxpc3QsIERCSVMgY2FuIHRoZW4gYmUgYWRkZWQgdG8gdGhlIG5ldyBMREFQRVhUIGNoYXJ0
ZXI/SSBoYXZlIHNvbWUgcGVvcGxlIHdobyBhcmUgaW50ZXJlc3RlZC4gIEknbGwgYXBwcm9hY2gg
dGhlbSBhbmQgc2VlIGlmIHRoZXkgY2FuIHNwYXJlIGFueSB0aW1lLk1hcmsuCgo=


------=_Part_0_1448456294123
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: base64
Content-Disposition: inline

PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6ICdDYWxpYnJpJywgJ3NhbnMtc2VyaWYnOyI+PHByZSBz
dHlsZT0id29yZC13cmFwOiBicmVhay13b3JkOyB3aGl0ZS1zcGFjZTogcHJlLXdyYXA7Ij4mZ3Q7
ICZndDsgKDEpIHNob3VsZCBiZSBwb3NzaWJsZS4gIElzIHRoZXJlIGFuIG9mZmljaWFsIHByb2Nl
c3MgYSByZXZpZXdlciBuZWVkcyB0bwomZ3Q7ICZndDsgZm9sbG93LCBpbiBvcmRlciB0byBjb3Vu
dCBhcyBhIHJldmlld2VyIGZvciB0aGlzIHB1cnBvc2U/CiZndDsKJmd0OyBObywgcGVvcGxlIGp1
c3QgbmVlZCB0byBwYXJ0aWNpcGF0ZSBpbiB0aGUgd29ya2luZyBncm91cCBkaXNjdXNzaW9ucywK
Jmd0OyBhbmQgcGFydCBvZiB0aGF0IHdvdWxkIGJlIHRoZSBkaXNjdXNzaW9ucyBvZiB0aGUgZG9j
dW1lbnRzIHdlJ3JlCiZndDsgdGFsa2luZyBhYm91dC48L3ByZT48cHJlIHN0eWxlPSJ3b3JkLXdy
YXA6IGJyZWFrLXdvcmQ7IHdoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPk9rIHRoYW5rcyBCYXJyeS4g
IFRoZW4gaWYgSSBjYW4gZmluZCBzb21lIHBlb3BsZSB3aG8gY2FuIG5vbWluYXRlIHRoZW1zZWx2
ZXMgYXMgcmV2aWV3ZXJzIG9uIHRoaXMgbWFpbGluZyBsaXN0LCBEQklTIGNhbiB0aGVuIGJlIGFk
ZGVkIHRvIHRoZSBuZXcgTERBUEVYVCBjaGFydGVyPzwvcHJlPjxwcmUgc3R5bGU9IndvcmQtd3Jh
cDogYnJlYWstd29yZDsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+SSBoYXZlIHNvbWUgcGVvcGxl
IHdobyBhcmUgaW50ZXJlc3RlZC4gIEknbGwgYXBwcm9hY2ggdGhlbSBhbmQgc2VlIGlmIHRoZXkg
Y2FuIHNwYXJlIGFueSB0aW1lLjwvcHJlPjxwcmUgc3R5bGU9IndvcmQtd3JhcDogYnJlYWstd29y
ZDsgd2hpdGUtc3BhY2U6IHByZS13cmFwOyI+TWFyay48L3ByZT4KCgo8L2Rpdj48YnI+


------=_Part_0_1448456294123--


From nobody Wed Nov 25 06:20:31 2015
Return-Path: <pspacek@redhat.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A2A6F1B2D48 for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 06:20:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.587
X-Spam-Level: 
X-Spam-Status: No, score=-5.587 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xr2LXA6LUfq0 for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 06:20:28 -0800 (PST)
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A2881B2D45 for <ldapext@ietf.org>; Wed, 25 Nov 2015 06:20:28 -0800 (PST)
Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 79C1AC0B7AA7 for <ldapext@ietf.org>; Wed, 25 Nov 2015 14:20:27 +0000 (UTC)
Received: from pspacek.brq.redhat.com (pspacek.brq.redhat.com [10.34.128.7]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id tAPEKPS2031947 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for <ldapext@ietf.org>; Wed, 25 Nov 2015 09:20:27 -0500
To: ldapext@ietf.org
References: <565478FA.6050502@stroeder.com>
From: Petr Spacek <pspacek@redhat.com>
X-Enigmail-Draft-Status: N1110
Organization: Red Hat
Message-ID: <5655C3A9.2040402@redhat.com>
Date: Wed, 25 Nov 2015 15:20:25 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <565478FA.6050502@stroeder.com>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/GJ3VYitj36wSaPpzhL_qvOZ5E4Y>
Subject: Re: [ldapext] OATH-LDAP as ldapext WG item?
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Nov 2015 14:20:29 -0000

On 24.11.2015 15:49, Michael Ströder wrote:
> HI!
> 
> Anyone here interested in co-authoring an I-D describing OATH-LDAP (presented
> at LDAPcon 2015)?
> 
> Is there general interest to add this as ldapext WG item?
> 
> I have a schema for HOTP/TOTP (see attachment) and a reference implementation
> for HOTP and some thoughts on operational considerations. TOTP schema might
> need some small work and I have to adapt the implementation.

You might be interested in HOTP/TOTP implementation which is available in
FreeIPA project. It is available in Fedora 22+ and CentOS 7.1+.

Related LDAP schema is on:
http://www.freeipa.org/page/V4/OTP/Schema

Feature design is on:
http://www.freeipa.org/page/V4/OTP

-- 
Petr Spacek  @  Red Hat


From nobody Wed Nov 25 07:34:41 2015
Return-Path: <michael@stroeder.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79C5B1B2E38 for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 07:34:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.887
X-Spam-Level: 
X-Spam-Status: No, score=-2.887 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.585, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id auGkFCtE5wWP for <ldapext@ietfa.amsl.com>; Wed, 25 Nov 2015 07:34:32 -0800 (PST)
Received: from srv1.stroeder.com (srv1.stroeder.com [213.240.180.113]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB8361B2E43 for <ldapext@ietf.org>; Wed, 25 Nov 2015 07:34:31 -0800 (PST)
Received: from srv4.stroeder.local (unknown [10.1.1.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail.stroeder.local", Issuer "stroeder.com Server CA no. 2009-07" (verified OK)) by srv1.stroeder.com (Postfix) with ESMTPS id DEC451CF58; Wed, 25 Nov 2015 15:34:28 +0000 (UTC)
Received: from nb2.stroeder.local (nb2.stroeder.local [10.1.1.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by srv4.stroeder.local (Postfix) with ESMTPS id 9FA921CF97; Wed, 25 Nov 2015 15:34:26 +0000 (UTC)
To: Petr Spacek <pspacek@redhat.com>, ldapext@ietf.org
References: <565478FA.6050502@stroeder.com> <5655C3A9.2040402@redhat.com>
From: =?UTF-8?Q?Michael_Str=c3=b6der?= <michael@stroeder.com>
Message-ID: <5655D502.8080103@stroeder.com>
Date: Wed, 25 Nov 2015 16:34:26 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:42.0) Gecko/20100101 SeaMonkey/2.39
MIME-Version: 1.0
In-Reply-To: <5655C3A9.2040402@redhat.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms020900020805010702010103"
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/VgPn9ygEACzIGmZmJq0Yw0gm7cI>
Subject: Re: [ldapext] OATH-LDAP as ldapext WG item?
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 25 Nov 2015 15:34:37 -0000

This is a cryptographically signed message in MIME format.

--------------ms020900020805010702010103
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Petr Spacek wrote:
> On 24.11.2015 15:49, Michael Str=F6der wrote:
>> HI!
>>
>> Anyone here interested in co-authoring an I-D describing OATH-LDAP (pr=
esented
>> at LDAPcon 2015)?
>>
>> Is there general interest to add this as ldapext WG item?
>>
>> I have a schema for HOTP/TOTP (see attachment) and a reference impleme=
ntation
>> for HOTP and some thoughts on operational considerations. TOTP schema =
might
>> need some small work and I have to adapt the implementation.
>=20
> You might be interested in HOTP/TOTP implementation which is available =
in
> FreeIPA project. It is available in Fedora 22+ and CentOS 7.1+.
>=20
> Related LDAP schema is on:
> http://www.freeipa.org/page/V4/OTP/Schema
>=20
> Feature design is on:
> http://www.freeipa.org/page/V4/OTP

I already know this and I expected you to point me at it. ;-)

But I decided not to use it. Especially my aim is to define a non-proprie=
tary
approach useful for different vendors.

Ciao, Michael.


--------------ms020900020805010702010103
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGYwggYqMIIFEqADAgECAgMPVg4wDQYJKoZIhvcNAQELBQAwgYwxCzAJBgNVBAYTAklMMRYw
FAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZp
Y2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJt
ZWRpYXRlIENsaWVudCBDQTAeFw0xNTA5MTAxNjMwMTdaFw0xNjA5MTAxNDA3NTBaMEQxHTAb
BgNVBAMMFG1pY2hhZWxAc3Ryb2VkZXIuY29tMSMwIQYJKoZIhvcNAQkBFhRtaWNoYWVsQHN0
cm9lZGVyLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ3ulgRkFW/ozuAX
8HwDmP7ifGF09KbLcAEVVjS013fTAlEzq0TJVcMXx/57LqdWtelCi35YvCzXHURuZl6hpUlR
+yOR1sev9xP2NfEJHQKUfs435wN6xFmdg/LI+ydlJ/exc3XxZVnb994vtJOlQh1HgXJvCORp
9d359fQQMY5N71TiQs0rcn8SNUBLZYHom1U2g2oEHN/QFNf2noxfXdPxTWeeeR0EuhH1Yy/0
AE2JZk2VmFW6VZYjEPoXUOfRizEzSM6HjyG347RnFd5Zh5vquxN609Z2iSg1Txuvd/eLSSuu
9sxLfw/5Qq4Xd/vhNVTrvG8d4M9L54orRVdFwmsCAwEAAaOCAtowggLWMAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQU
ubJgGvVtleGfzm7tjClKT2uUcB4wHwYDVR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIw
HwYDVR0RBBgwFoEUbWljaGFlbEBzdHJvZWRlci5jb20wggFMBgNVHSAEggFDMIIBPzCCATsG
CysGAQQBgbU3AQIDMIIBKjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20v
cG9saWN5LnBkZjCB9wYIKwYBBQUHAgIwgeowJxYgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBB
dXRob3JpdHkwAwIBARqBvlRoaXMgY2VydGlmaWNhdGUgd2FzIGlzc3VlZCBhY2NvcmRpbmcg
dG8gdGhlIENsYXNzIDEgVmFsaWRhdGlvbiByZXF1aXJlbWVudHMgb2YgdGhlIFN0YXJ0Q29t
IENBIHBvbGljeSwgcmVsaWFuY2Ugb25seSBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2UgaW4g
Y29tcGxpYW5jZSBvZiB0aGUgcmVseWluZyBwYXJ0eSBvYmxpZ2F0aW9ucy4wNgYDVR0fBC8w
LTAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNzbC5jb20vY3J0dTEtY3JsLmNybDCBjgYIKwYB
BQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9j
bGFzczEvY2xpZW50L2NhMEIGCCsGAQUFBzAChjZodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9j
ZXJ0cy9zdWIuY2xhc3MxLmNsaWVudC5jYS5jcnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5z
dGFydHNzbC5jb20vMA0GCSqGSIb3DQEBCwUAA4IBAQAv5aQr1I7ZAg4VJJtaPIi61v/v0v9j
Hs/Gl695n7shMeZx/H5F6EAwma0MWIWv1H9mtFcGhXiwr55SR1xMffy+C2Q5byyVcVKmrC+E
vP1Ke+VnJ6v/l3JV5zPQf38XdCvYQACHFIODnVmD5JI59TWzS5ReudfTf60kQeNoRTZH15el
8hORNOzkoGiV70Kuuw7pCOf0ncjshttJE3NetXa2f4rTsCC5UNrMqhF8Y6NALa3m/zzCK1+i
nvukFQPBU3+NFeNcrpp2nroEutsl3ftkcw6jAvQvTGEIw6AO13fgujtge+kxyoF2RuCSsEmT
jmyZ7QweLwfmuU70umVTM8HUMIIGNDCCBBygAwIBAgIBHjANBgkqhkiG9w0BAQUFADB9MQsw
CQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERp
Z2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UEAxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkwHhcNMDcxMDI0MjEwMTU1WhcNMTcxMDI0MjEwMTU1WjCBjDELMAkG
A1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdp
dGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJp
bWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAxwmDzM4t2BqxKaQuE6uWvooyg4ymiEGWVUet1G8SD+rqvyNH4QrvnEIaFHxOhESi
p7vMz39ScLpNLbL1QpOlPW/tFIzNHS3qd2XRNYG5Sv9RcGE+T4qbLtsjjJbi6sL7Ls/f/X9f
tTyhxvxWkf8KW37iKrueKsxw2HqolH7GM6FX5UfNAwAu4ZifkpmZzU1slBhyWwaQPEPPZRsW
oTb7q8hmgv6Nv3Hg9rmA1/VPBIOQ6SKRkHXG0Hhmq1dOFoAFI411+a/9nWm5rcVjGcIWZ2v/
43Yksq60jExipA4l5uv9/+Hm33mbgmCszdj/Dthf13tgAv2O83hLJ0exTqfrlwIDAQABo4IB
rTCCAakwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFNy7ZKc
4NrLAVx8fpY1TvLUuFGCMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7yMGYGCCsG
AQUFBwEBBFowWDAnBggrBgEFBQcwAYYbaHR0cDovL29jc3Auc3RhcnRzc2wuY29tL2NhMC0G
CCsGAQUFBzAChiFodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9zZnNjYS5jcnQwWwYDVR0fBFQw
UjAnoCWgI4YhaHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMCegJaAjhiFodHRw
Oi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwgYAGA1UdIAR5MHcwdQYLKwYBBAGBtTcB
AgEwZjAuBggrBgEFBQcCARYiaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5LnBkZjA0
BggrBgEFBQcCARYoaHR0cDovL3d3dy5zdGFydHNzbC5jb20vaW50ZXJtZWRpYXRlLnBkZjAN
BgkqhkiG9w0BAQUFAAOCAgEACoMIfXirLAZcuGOMXq4cuSN3TaFx2H2GvD5VSy/6rV55BYHb
WNaPeQn3oBSU8KgQZn/Kck1JxbLpAxVCNtsxeW1R87ifhsYZ0qjdrA9anrW2MAWCtosmAOT4
OxK9QPoSjCMxM3HbkZCDJgnlE8jMopH21BbyAYr7b5EfGRQJNtgWcvqSXwKHnTutR08+Kkn0
KAkXCzeQNLeA5LlYUzFyM7kPAp8pIRMQ+seHunmyG642S2+y/qHEdMuGIwpfz3eDF1PdctL0
4qYK/zu+Qg1Bw0RwgigVZs/0c5HP2/e9DBHh7eSwtzYlk4AUr6yxLlcwSjOfOmKEQ/Q8tzh0
IFiNu9IPuTGAPBn4CPxD0+Ru8T2wg8/s43R/PT3kd1OEqOJUl7q+h+r6fpvU0Fzxd2tC8Ga6
fDEPme+1Nbi+03pVjuZQKbGwKJ66gEn06WqaxVZC+J8hh/jR0k9mST1iAZPNYulcNJ8tKmVt
jYsv0L1TSm2+NwON58tO+pIVzu3DWwSEXSf+qkDavQam+QtEOZxLBXI++aMUEapSn+k3Lxm4
8ZCYfAWLb/Xj7F5JQMbZvCexglAbYR0kIHqW5DnsYSdMD/IplJMojx0NBrxJ3fN9dvX2Y6BI
XRsF1du4qESm4/3CKuyUV7p9DW3mPlHTGLvYxnyKQy7VFBkoLINszBrOUeIxggPtMIID6QIB
ATCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsT
IlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxODA2BgNVBAMTL1N0YXJ0Q29t
IENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50IENBAgMPVg4wDQYJYIZIAWUD
BAIBBQCgggIpMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE1
MTEyNTE1MzQyNlowLwYJKoZIhvcNAQkEMSIEIOFg48O90JQqYvyjRYypEtXqjFheHDXpqqfA
Vp1r6V5QMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggq
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZI
hvcNAwICASgwgaUGCSsGAQQBgjcQBDGBlzCBlDCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoT
DVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNp
Z25pbmcxODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDEgUHJpbWFyeSBJbnRlcm1lZGlhdGUg
Q2xpZW50IENBAgMPVg4wgacGCyqGSIb3DQEJEAILMYGXoIGUMIGMMQswCQYDVQQGEwJJTDEW
MBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlm
aWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVy
bWVkaWF0ZSBDbGllbnQgQ0ECAw9WDjANBgkqhkiG9w0BAQEFAASCAQCIw87U6gWvGa8y0LKX
RHR7n6PhvJLQZK3rwckFbGhaVJvzf8TPZW6DJL78xlENMqKUobmqieJtylzQNWokgEB5Ai6e
MChkuptBx8bLuBLmOQiFW8cnQFPouy9Vr5drthrJPhCPNpNkiUCf9ujozI69Wy3/4G0iZmDs
qmzd7/y+zVoJf0E3YtzBtiwfswDrttflJdYNbKdOSq656iYPU45tPa0+d8jSgI1esq6ZvloD
VlFLTzPXv0OwVsyP0CBHVdNS956uZ/6BpKdgqkqynr76Y7c/lRvsu+3UQOJE3GZi6adsc1e3
fexUg3Sk28XXPa3uJZDOYmBOm8SkGg+r/Q4RAAAAAAAA
--------------ms020900020805010702010103--


From nobody Thu Nov 26 03:01:53 2015
Return-Path: <Mark.Bannister@morganstanley.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41BC21B3956 for <ldapext@ietfa.amsl.com>; Thu, 26 Nov 2015 03:01:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level: 
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CBm5ddmBgVMQ for <ldapext@ietfa.amsl.com>; Thu, 26 Nov 2015 03:01:48 -0800 (PST)
Received: from pimtaint03.ms.com (pimtaint03.ms.com [199.89.103.73]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C13D1B3955 for <ldapext@ietf.org>; Thu, 26 Nov 2015 03:01:48 -0800 (PST)
Received: from pimtaint03 (localhost.ms.com [127.0.0.1]) by pimtaint03.ms.com (output Postfix) with ESMTP id 369FD2B34389 for <ldapext@ietf.org>; Thu, 26 Nov 2015 06:01:47 -0500 (EST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=morganstanley.com; s=p20150724; t=1448535707; x=1449745307; bh=3EPGvZDWPCL8Iblwa4Aa/0UL+Udo7et595ewcoTf4VU=; h=From:To:CC:Subject:Date:Message-ID:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:MIME-Version; b=gWu0/uY3d5AbAyMKiTTPwklMHTkE/j0U83yzwhzeKO7Xsl9FSjZG10DM9P4WqQdBu NYoDUmVIJR3AsAmmKzf5wcxsvFi9GIWzePK9jse/vzADmki7X8QtUYoc7MFjgkMoN9 9rk3fcRLVQ+QwbUVbTnmqmTYQOFkPOktAQD1WAo8=
Received: from hzsmmta04.ms.com (hzsmmta04.ms.com [10.203.140.139]) by pimtaint03.ms.com (internal Postfix) with ESMTP id 195032B3436A; Thu, 26 Nov 2015 06:01:47 -0500 (EST)
Received: from HZWEX2004N4.msad.ms.com (hzwex2004n4.ms.com [10.195.143.202]) by hzsmmta04.ms.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id tAQB1kuD023585; Thu, 26 Nov 2015 11:01:47 GMT
Received: from RRWEX2010N1.msad.ms.com (10.196.137.204) by HZWEX2004N4.msad.ms.com (10.195.143.202) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 26 Nov 2015 06:01:46 -0500
Received: from OZWEX0206N2.msad.ms.com (10.208.87.93) by RRWEX2010N1.msad.ms.com (10.196.137.204) with Microsoft SMTP Server (TLS) id 14.3.235.1; Thu, 26 Nov 2015 06:01:46 -0500
Received: from OZWEX0209N1.msad.ms.com ([10.208.87.89]) by OZWEX0206N2.msad.ms.com ([10.208.87.93]) with mapi id 14.03.0235.001; Thu, 26 Nov 2015 11:01:45 +0000
From: "Bannister, Mark" <Mark.Bannister@morganstanley.com>
To: "'Jordan Brown'" <Jordan.Brown@oracle.com>
Thread-Topic: DBIS commentary
Thread-Index: AQHRJ6BIKlY+hp6UAEOXycsas61P9Z6uB0MA
Date: Thu, 26 Nov 2015 11:01:44 +0000
Message-ID: <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
References: <5655E4F0.7030809@oracle.com>
In-Reply-To: <5655E4F0.7030809@oracle.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
x-mspolicyagent: version=1.0
x-originating-ip: [10.173.255.32]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-EXCLAIMER-MD-CONFIG: be3bdf5c-71de-49fb-a1b7-ad6a6a1df5e2
X-EXCLAIMER-MD-CONFIG: f2a46809-d95e-4647-8996-91897c738879
X-KLMS-Rule-ID: 1
X-KLMS-Message-Action: clean
X-KLMS-AntiSpam-Status: not scanned, disabled by settings
X-KLMS-AntiPhishing: not scanned, disabled by settings
X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.705, bases: 2015/11/25 22:59:00 #6787864; khse: 2014-03-12 13:55:01
X-KLMS-AntiVirus-Status: Clean, skipped
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/4Ta-2hjx5w41WUV2VUO2PZCzn1M>
Cc: "'ldapext@ietf.org'" <ldapext@ietf.org>
Subject: Re: [ldapext] DBIS commentary
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Nov 2015 11:01:52 -0000

77u/SGkgSm9yZGFuLA0KDQpUaGlzIGlzIGFsbCBleGNlbGxlbnQgZmVlZGJhY2ssIHRoYW5rcywg
SSByZWFsbHkgYXBwcmVjaWF0ZSB0aGUgdGltZSB5b3UgaGF2ZSB0YWtlbiB0byBwcm92aWRlIHlv
dXINCmNvbW1lbnRzLiAgTWFueSBvZiB0aGUgcG9pbnRzIHlvdSByYWlzZSBJIGRpZCBzcGVuZCBh
IGxvbmcgdGltZSBjb25zaWRlcmluZyBteXNlbGYgd2hlbiBJIHdhcw0Kd3JpdGluZyB0aGUgaW50
ZXJuZXQgZHJhZnRzLCBzbyBJIGhvcGUgdG8gcHJvdmlkZSB5b3Ugd2l0aCBtb3JlIGluc2lnaHQg
aW50byBteSByYXRpb25hbGUgYW5kIHdoeQ0KSSBkZWNpZGVkIHRvIGRvIHRoaW5ncyB0aGUgd2F5
IEkgZGlkLg0KDQpJIGhvcGUgeW91IGRvbid0IG1pbmQgYnV0IEknbSBjb3B5aW5nIGl0IHRvIHRo
ZSBsZGFwZXh0IG1haWxpbmcgbGlzdCwgc28gdGhhdCBvdGhlcnMgY2FuIGFsc28NCmNvbW1lbnQg
aWYgdGhleSB3aXNoLiAgRm9yIG90aGVycywgSm9yZGFuIGlzIGNvbW1lbnRpbmcgZnJvbSB0aGUg
REJJUy9SRkMyMzA3DQpzY2hlbWEgY29tcGFyaXNvbiBhbmQgbm90IGRpcmVjdGx5IGZyb20gdGhl
IGludGVybmV0IGRyYWZ0czoNCg0KaHR0cDovL3NvdXJjZWZvcmdlLm5ldC9wL2RiaXMvd2lraS9E
QklTJTIwYW5kJTIwUkZDMjMwNyUyMHNjaGVtYXMvDQoNCkpvcmRhbiBCcm93biB3cm90ZToNCj4g
SGlnaC1sZXZlbCBjb21tZW50czoNCj4gLSBJbiBnZW5lcmFsLCBvdXIgZGlyZWN0aW9uIGlzIHRv
d2FyZHMgWC41MDAgY29tcGF0aWJpbGl0eSBhbmQgQWN0aXZlIERpcmVjdG9yeSBjb21wYXRpYmls
aXR5LiAgSSB3b3VsZA0KPiAgIHJlc2lzdCBuZXcgbWVjaGFuaXNtcyB0aGF0IGR1cGxpY2F0ZSB0
aG9zZS4NCj4gLSBBcyBub3RlZCBpbiBtb3JlIGRldGFpbCBiZWxvdywgSSBjb25zaWRlciBjYXNl
LWluc2Vuc2l0aXZlIHByb2Nlc3NpbmcgdG8gYmUgdGhlIGNvcnJlY3QgZGlyZWN0aW9uIGFuZA0K
PiAgIHdvdWxkIHJlc2lzdCBtb3ZlcyB0b3dhcmRzIGNhc2Ugc2Vuc2l0aXZpdHkuDQo+IC0gU29t
ZSBvZiB0aGUgbWVjaGFuaXNtcyBoZXJlIChlLmcuIGdlY29zIG1hcHBpbmcpIHNlZW0gdG8gZHVw
bGljYXRlIFJGQyA0ODc2IHByb2ZpbGVzLg0KDQpUaGFua3MgZm9yIHRoZSBzdW1tYXJ5LCBJJ2xs
IGFuc3dlciB0aGVzZSBwb2ludHMgaW5kaXZpZHVhbGx5IGFzIEkgZ2V0IHRvIHRoZW0gYmVsb3cu
DQoNCj4gDQo+IEZvb3Rub3RlIDEgc2F5cyB0aGF0IHB1Ymxpc2hlZCBjbGFzc2VzIG1heSBub3Qg
YmUgcmVkZWZpbmVkLiBBbHRob3VnaCBub3QgYWxsIGNoYW5nZXMgc2VlbSBwZXJtaXNzaWJsZSwN
Cj4gc29tZSBjaGFuZ2VzIChlLmcuIGFkZGl0aW9uIG9mIE1BWSBlbGVtZW50cykgc2VlbSBsaWtl
IHRoZXkgY291bGQgYmUgYWxsb3dlZC4gIElzIHRoZXJlIGEgcmVmZXJlbmNlIGZvcg0KPiB0aGlz
IHJlc3RyaWN0aW9uPyAgTm90ZSB0aGF0IGJldHdlZW4gWC41MjEtMTk5MyBhbmQgWC41MjEtMjAx
MiB0aGUgVGVsZWNvbW11bmljYXRpb25BdHRyaWJ1dGVTZXQgaGFkDQo+IGFuIGF0dHJpYnV0ZSBk
ZWxldGVkLg0KDQpJIGhhdmVuJ3QgbG9va2VkIGZvciBhIHJlZmVyZW5jZSB0byB0aGlzIHJlc3Ry
aWN0aW9uLCBJIGhhZCBsZWFybmVkIGl0IGZyb20gc2VlaW5nIHByZXZpb3VzIGV4Y2hhbmdlcw0K
b24gdGhlIGxkYXBleHQgbWFpbGluZyBsaXN0IHdpdGggS3VydCBaZWlsZW5nYS4gIEhlcmUgaXMg
b25lIHN1Y2ggZXhjaGFuZ2UsIHJlZ2FyZGluZyBjaGFuZ2luZyB0aGUNCnNjaGVtYSBkZWNsYXJh
dGlvbiBvZiAncG9zaXhHcm91cCcgaW4gUkZDMjMwN2JpczoNCg0KaHR0cHM6Ly93d3cuaWV0Zi5v
cmcvbWFpbC1hcmNoaXZlL3dlYi9sZGFwZXh0L2N1cnJlbnQvbXNnMDIwNzIuaHRtbA0KDQo+DQo+
IHBvc2l4QWNjb3VudCAvIHBvc2l4VXNlckFjY291bnQNCj4gDQo+IGVuOiAgSSBjb25zaWRlciB0
aGUgY2hhbmdlIGZyb20gYSBjYXNlLXNlbnNpdGl2ZSBuYW1lIGluIE5JUyB0byBhIGNhc2UtaW5z
ZW5zaXRpdmUgbmFtZSBpbiBMREFQIHRvIGJlIGFuDQo+IGltcHJvdmVtZW50IHRoYXQgc2hvdWxk
IG5vdCBiZSByZXZlcnNlZC4gIEl0IGlzIHRlbGxpbmcgdGhhdCAoYSkgdGhlcmUgYXJlIG5vIGNh
c2VzIGluIHRoZSBpbmR1c3RyeSBvdGhlcg0KPiB0aGFuIFVOSVggdXNlciBuYW1lcyB3aGVyZSB1
c2VyIG5hbWVzIGFyZSBjYXNlIHNlbnNpdGl2ZSwgKGIpIHRoYXQgdGhlcmUgYXJlIG51bWVyb3Vz
IGV4YW1wbGVzIGluDQo+IHRoZSBpbmR1c3RyeSBvZiB0cmVhdGluZyB0aGUgbGVmdCBzaWRlIG9m
IGFuIGUtbWFpbCBhZGRyZXNzIGFzIGNhc2UtaW5zZW5zaXRpdmUsIGFuZCAoYykgdGhlIFguNTIw
ICJuYW1lIg0KPiBhdHRyaWJ1dGUsIHRoZSBiYXNlIGF0dHJpYnV0ZSBmb3IgYWxsIG5hbWluZywg
aXMgY2FzZS1pbnNlbnNpdGl2ZS4NCg0KTklTIHdhcyBjYXNlIHNlbnNpdGl2ZS4gIFRoYXQgbGVk
IHNvbWUgZmlybXMgdG8gcHV0IGVudHJpZXMgaW4gdmFyaW91cyBtYXBzIHRoYXQgd2VyZSB0aGUg
c2FtZSBleGNlcHQNCmZvciBjYXNlLiAgSSBoYXZlIGV4YW1wbGVzIGhlcmUgd2hlcmUgdGhpcyBv
Y2N1cnMgaW4gdGhlIHBhc3N3ZCwgZ3JvdXAsIG5ldGdyb3VwIGFuZCBzZXJ2aWNlcyBtYXBzLg0K
Q2hhbmdpbmcgdGhlc2UgZW50cmllcyB3b3VsZCBiZSBhKSB2ZXJ5IGRpZmZpY3VsdCBpbmRlZWQg
dG8gdGhlIHBvaW50IG9mIGluc3VybW91bnRhYmxlIGFzIHRoZXkndmUNCmJlZW4gaW5ncmFpbmVk
IGluIG1hbnkgc3lzdGVtcyBpbiBhIHZlcnkgbGFyZ2UgZW50ZXJwcmlzZSBmb3Igb3ZlciBhIGRl
Y2FkZSBhbmQgYikgdW5uZWNlc3NhcnkgaGFkDQp0aGUgUkZDMjMwNyBzY2hlbWEgYmVlbiAxMDAl
IGJhY2t3YXJkcyBjb21wYXRpYmxlIHdpdGggTklTLiAgSSBleHBsYWluIHRoaXMgcmF0aW9uYWxl
IGZ1cnRoZXIgaW4gbXkNCkRCSVMgcGFwZXI6DQoNCmh0dHA6Ly9sZGFwY29uLm9yZy8yMDE1L3dw
LWNvbnRlbnQvdXBsb2Fkcy8yMDE1LzA5L0RCSVMtUGFwZXItMjAxNS5wZGYNCg0KV2UgaGFkIGEg
ZmV3IGNob2ljZXMuICBUaGUgb25lIHdoaWNoIHdlIHVzZWQgZm9yIHRoZSBwYXN0IGZldyB5ZWFy
cyB3YXMgdG8gZGVmaW5lIG91ciBvd24gY3VzdG9tDQpzY2hlbWEuICBXZSBoYWQgdG8gaW52ZW50
IHRocmVlIG5ldyBjdXN0b20gYXR0cmlidXRlcyBhbmQgc2V2ZW4gbmV3IGN1c3RvbSBvYmplY3Qg
Y2xhc3NlcyB0bw0KZ2V0IGFyb3VuZCB0aGlzIGxpbWl0YXRpb24uICBJdCBpbmZ1cmlhdGVkIG1l
IHRoYXQgd2UgY291bGRuJ3QgdXNlIFJGQzIzMDcgb3V0LW9mLXRoZS1ib3ggYmVjYXVzZSBpdA0K
d2FzIG5vdCAxMDAlIGNvbXBhdGlibGUgd2l0aCB0aGUgTklTIHNjaGVtYSwgYW5kIHRoaXMgd2Fz
IG9uZSBvZiB0aGUgcHJpbWFyeSBkcml2aW5nIGZvcmNlcw0KYmVoaW5kIG1lIHN0YXJ0aW5nIERC
SVMuDQoNCkRCSVMgaXMgbXkgc3Rha2UgaW4gdGhlIGdyb3VuZCB0byBzYXkgd2UgTVVTVCBzb2x2
ZSB0aGlzIHByb2JsZW0uICBJIGhlYXIgd2hhdCB5b3UncmUgc2F5aW5nLA0KYnV0IHlvdXIgYXJn
dW1lbnRzIGZvciBjYXNlIGluc2Vuc2l0aXZpdHkgZGlzcmVnYXJkIHRoYXQgVU5JWCBpcyBwcmlt
YXJpbHkgYSBjYXNlLXNlbnNpdGl2ZQ0Kb3BlcmF0aW5nIHN5c3RlbSBhbmQgdGhhdCBOSVMgd2Fz
IGFsc28gY2FzZS1zZW5zaXRpdmUuICBGcmFua2x5LCBhcyBSRkMyMzA3IHdhcyBzdXBwb3NlZCB0
bw0KYmUgcHJpbWFyaWx5IGdldHRpbmcgTklTIGRhdGEgaW50byBMREFQLCBpdCBmYWlsZWQgdHJl
bWVuZG91c2x5IGJ5IGJlbmRpbmcgdG8gdGhlIFdpbmRvd3MvQUQNCmNhc2UgaW5zZW5zaXRpdml0
eSBwcmVmZXJlbmNlcy4gIFVOSVggd2lsbCBub3QgY2hhbmdlLiAgSXQgd2lsbCBhbHdheXMgYmUg
Y2FzZSBzZW5zaXRpdmUuICBUaGVyZWZvcmUNCndlIG5lZWQgYW4gTERBUCBzY2hlbWEgdGhhdCB3
aWxsIHJlc3BlY3QgdGhhdC4NCg0KSSBob3BlIHRoaXMgZG9lc24ndCBtZWFuIHdlIGVuZCB1cCB3
aXRoIG9uZSBzY2hlbWEgZm9yIFVOSVggYW5kIG9uZSBmb3IgV2luZG93cywgcGVyaGFwcw0Kd2Ug
Y2FuIGJlIGNyZWF0aXZlLCBmb3IgZXhhbXBsZSwgZW5jb3VyYWdpbmcgV2luZG93cyBzb2Z0d2Fy
ZSB0byBmb3JjZSBhbGwgY2hhcmFjdGVycyB0bw0KbG93ZXJjYXNlIGJlZm9yZSBhZGRpbmcgZW50
cmllcyB0byBMREFQIGFuZCBjb25zdHJ1Y3Rpbmcgc2VhcmNoIGZpbHRlcnMsIGFsdGhvdWdoIHRo
aXMgd2lsbA0KcHJvYmFibHkgYmUgcHJvbmUgdG8gYnJlYWthZ2UuICBPciBwZXJoYXBzIHdlIGNh
biBkZWZpbmUgc29tZSBzcGVjaWFsIGF0dHJpYnV0ZXMgd2hlcmUgY2FzZQ0KaXMgaGFuZGxlZCBk
aWZmZXJlbnRseSBkZXBlbmRpbmcgb24gdGhlIGNhcGFiaWxpdHkgb2YgdGhlIGNsaWVudC4gIElm
IHRoZSBjbGllbnQgY2xhaW1zIGl0IGlzDQpjYXNlIHNlbnNpdGl2ZSwgdGhlc2Ugc3BlY2lhbCBh
dHRyaWJ1dGVzIGFyZSBoYW5kbGVkIGNhc2Ugc2Vuc2l0aXZlbHksIGFuZCB2aWNlIHZlcnNhIGlm
IHRoZSBjbGllbnQNCmNsYWltcyBpdCBpcyBjYXNlIGluc2Vuc2l0aXZlLiAgSSBzZWUgY2FzZSBz
ZW5zaXRpdml0eSBhcyBhbiBpc3N1ZSB0aGF0IHdpbGwgcHJldmFpbCBmb3JldmVyLCBpbiB0aGUN
CnNhbWUgd2F5IHRoYXQgZW5kaWFubmVzcyB3aWxsIGRpZmZlciBiZXR3ZWVuIGFyY2hpdGVjdHVy
ZXM7IHRoZXkgd2lsbCBuZXZlciBjb252ZXJnZSBhbmQNCnNvIHdlIHNob3VsZCBub3QgYmUgYWNj
ZXB0aW5nIHN0YW5kYXJkcyB0aGF0IGRvIG5vdCBwcm92aWRlIGEgc29sdXRpb24gZm9yIGJvdGgg
dHlwZXMuDQoNCj4NCj4gYXV0aFBhc3N3b3JkOiAgSW1wb3J0ZWQgZnJvbSBSRkMyMzA3YmlzLTAy
IGFuZCB0aGVuY2UgZnJvbSBSRkMgMzExMi4gIFBhcnRpYWxseSwgYnV0IG9ubHkgcGFydGlhbGx5
LA0KPiBkdXBsaWNhdGVzIHVzZXJQYXNzd29yZCAoZnJvbSBYLjUwOSB2aWEgUkZDMjMwNykuICBB
cHBlYXJzIHRvIGNvbXBsZXRlbHkgZHVwbGljYXRlIHVzZXJQd2QgKGFsc28NCj4gZnJvbSBYLjUw
OSkuICBNYXkgYWxzbyBkdXBsaWNhdGUgZW5jcnlwdGVkVXNlclBhc3N3b3JkLCBtZW50aW9uZWQg
aW4gWC41MjAgYnV0IG5vdCBkZWZpbmVkDQo+IGFueXdoZXJlIHRoYXQgSSBjYW4gZmluZC4NCg0K
SSBhZGRlZCBhdXRoUGFzc3dvcmQgc2ltcGx5IGJlY2F1c2UgSSB3YW50ZWQgdGhvc2UgdXNpbmcg
UkZDMjMwN2JpcyB0byBiZSBhYmxlIHRvIG1pZ3JhdGUNCnNlYW1sZXNzbHkgdG8gREJJUy4gIEkg
bWFkZSBpdCBjbGVhciBpbiB0aGUgZHJhZnRzIHRoYXQgdGhlcmUgYXJlIGJldHRlciBhbmQgbW9y
ZSBzZWN1cmUgd2F5cyB0byBzdG9yZQ0KcGFzc3dvcmRzIGFuZCB0aGVzZSBzaG91bGQgYmUgdXNl
ZCBpbiBwcmVmZXJlbmNlIC0gYXV0aFBhc3N3b3JkIHdhcyBwcm92aWRlZCBmb3IgYmFja3dhcmRz
DQpjb21wYXRpYmlsaXR5IG9ubHkuDQoNCklmIHlvdSBoYXZlIGFuIGlzc3VlIHdpdGggYXV0aFBh
c3N3b3JkIGJlaW5nIGluIFJGQzIzMDdiaXMsIG5vdyBpcyB0aGUgdGltZSB0byByYWlzZSBpdCwg
YXMgaXQNCmlzIG9uIHRoZSBuZXcgTERBUEVYVCBjaGFydGVyIGFuZCB0aGUgV0cgYXJlIHBsYW5u
aW5nIHRvIGZpbmFsaXNlIFJGQzIzMDdiaXMgaW4gdGhlDQpuZXh0IDEyIG1vbnRocyBhbmQgZ2l2
ZSBpdCBpdHMgb3duIFJGQyBudW1iZXIuDQoNCj4NCj4gZ2Vjb3M6ICBSZW1vdmVkIGluIERCSVMg
d2l0aCBubyBleHBsaWNpdCByZXBsYWNlbWVudC4gIERCSVMgcmVjb21tZW5kcyB1c2luZyBpdHMg
bWFwcGluZyBjYXBhYmlsaXRpZXMNCj4gdG8gbWFwIGdlY29zIG9udG8gc29tZSBvdGhlciBhdHRy
aWJ1dGUsIGUuZy4gZGlzcGxheU5hbWUuICBXaGlsZSBlbGltaW5hdGluZyBnZWNvcyBzZWVtcyBk
ZXNpcmFibGUNCj4gKGFzIGFuIHVubmVjZXNzYXJpbHkgVU5JWC1zcGVjaWZpYyBhdHRyaWJ1dGUp
LCBpdCBzZWVtcyBkZXNpcmFibGUgdG8gZXhwbGljaXRseSBzcGVjaWZ5IGEgcmVwbGFjZW1lbnQN
Cj4gcmF0aGVyIHRoYW4gdG8gcmVseSBvbiBjdXN0b20gbWFwcGluZy4gIChOb3RlIGFsc28gdGhh
dCBzb21lIGltcGxlbWVudGF0aW9ucyBoYXZlIGVuY29kZWQNCj4gYWRkaXRpb25hbCBpbmZvcm1h
dGlvbiwgZS5nLiB0ZWxlcGhvbmUgbnVtYmVyLCBpbnRvIHRoZSBnZWNvcyBmaWVsZC4gIFRoaXMg
c2VlbXMgbGlrZSBhbiB1bmRlc2lyYWJsZQ0KPiBvdmVybG9hZGluZyBvZiB0aGUgc2NoZW1hLikN
Cg0KTERBUCBpcyBzbyBtdWNoIGJldHRlciBhdCByZXByZXNlbnRpbmcgYWxsIGtpbmRzIG9mIHJh
bmRvbSBpbmZvcm1hdGlvbiB0aGFuIE5JUyB3YXMsIGFuZCB0aGUgcGFzc3dkDQpmbGF0LXRleHQg
ZmlsZS4gIEp1c3QgYmVjYXVzZSB0aGVyZSB3YXMgYSByYW5kb20gInRocm93IGluIGFueSBpbmZv
cm1hdGlvbiB5b3UgbGlrZSIgaW5jbHVkaW5nIGFuDQppbXBsaWVkIGVuY291cmFnZW1lbnQgaW4g
U3VuIE1pY3Jvc3lzdGVtcycgdHJhaW5pbmcgY291cnNlcyB0byBpbmNsdWRlIHRlbGVwaG9uZSBp
bmZvcm1hdGlvbg0KaW4gdGhlIGdlY29zIGZpZWxkLCBkb2VzIG5vdCBtZWFuIHRoYXQgd2hlbiB5
b3UgbW92ZSB0byBhIG11Y2ggbW9yZSBzdHJ1Y3R1cmVkIHN5c3RlbSBzdWNoDQphcyBMREFQIHlv
dSBoYXZlIHRvIGtlZXAgdGhlIGdlbmVyYWwgcHVycG9zZSBub25zZW5zZS4gIElmIHlvdSB3YW50
IHRvIGVuY29kZSBhIHRlbGVwaG9uZSBudW1iZXIsIA0KdGhlcmUgaXMgYW4gYXR0cmlidXRlIGZv
ciB0aGF0LiAgSWYgeW91IHdhbnQgYSBzdXJuYW1lLCBvciBhIGZpcnN0IG5hbWUsIHRoZXJlIGFy
ZSBhdHRyaWJ1dGVzIGZvciB0aGF0DQp0b28uICAiR2Vjb3MiIGlzIG5vdCBhIHVuaXF1ZSBwaWVj
ZSBvZiBpbmZvcm1hdGlvbiwgaXQgaXMgYSBjb250YWluZXIgZm9yIGFuIGFzc29ydG1lbnQgb2Yg
ZGF0YSwgd2hpY2gNCndpbGwgZGlmZmVyIGZyb20gb25lIGZpcm0gdG8gdGhlIG5leHQuICBUaGUg
ZXF1aXZhbGVudCB0byAiZ2Vjb3MiIGlzIGFuIExEQVAgb2JqZWN0Lg0KDQo+DQo+IGRlc2NyaXB0
aW9uOiAgUmVtb3ZlZCBmcm9tIGV4cGxpY2l0IG1lbnRpb24gaW4gREJJUywgYnV0IGluaGVyaXRl
ZCBmcm9tIFBlcnNvbiBpZiBpbmV0T3JnUGVyc29uIGlzDQo+IHVzZWQgYXMgdGhlIGJhc2UgY2xh
c3MuICBOb3QgY2xlYXIgaG93IGl0IGZpdHMgaW50byB0aGUgVU5JWC9OSVMgc2NoZW1hLg0KDQpJ
IHJlbW92ZWQgaXQgYmVjYXVzZSBJIHNhdyBubyBwdXJwb3NlIGZvciBpdCBvbiBhIHBhc3N3ZCBl
bnRyeSwgYW5kIGFzIHlvdSBzYXkgeW91IGNhbiBnZXQgaXQNCmJhY2sgYWdhaW4gaWYgeW91IGlu
Y2x1ZGUgYW5vdGhlciBhdXhpbGlhcnkgY2xhc3Mgd2hpY2ggeW91IHByb2JhYmx5IHdhbnQgdG8g
ZG8NCmFueXdheSB0byBoYXZlIHNvbWV0aGluZyB0byBtYXAgZ2Vjb3MgdG8uDQoNCj4NCj4gU3Ry
dWN0dXJhbCBVc2VyIEFjY291bnQ6ICBjaGFuZ2VzIGZyb20gImFjY291bnQiIChSRkMgNDUyNCkg
dG8gImluZXRPcmdQZXJzb24iIA0KPiAoUkZDIDI3OTgpLiAgV2hpbGUgdGhpcyBpcyBhbiBvYnZp
b3VzIHNpbXBsaWZpY2F0aW9uLCBpdCBkb2VzIG5vdCBzZWVtIGNvcnJlY3QuICANCj4gQW4gYWNj
b3VudCBtYXkgYmUgYXNzb2NpYXRlZCB3aXRoIG1vcmUgdGhhbiBvbmUgcGVyc29uLCBhbmQgb25l
IHBlcnNvbiBtYXkgYmUgYXNzb2NpYXRlZCB3aXRoDQo+IG1vcmUgdGhhbiBvbmUgYWNjb3VudC4g
IChIb3dldmVyLCBhc3NvY2lhdGluZyBpdCB3aXRoICJhY2NvdW50IiANCj4gbGVhdmVzIGl0IHVu
Y2xlYXIgd2hlcmUgdG8gY29sbGVjdCBhIGdlY29zL2Rpc3BsYXkgbmFtZSwgZXhjZXB0IHBlcmhh
cHMNCj4gImRlc2NyaXB0aW9uIi4pDQoNClF1aXRlLCAiYWNjb3VudCIgZG9lc24ndCBoYXZlIGEg
ZmllbGQgd2hlcmUgeW91IGNhbiBzZW5zaWJseSBwdXQgdGhlIGRlc2NyaXB0aXZlDQpuYW1lIG9m
IHRoZSB1c2VyLCB3aGVyZWFzIGluZXRPcmdQZXJzb24gZG9lcy4gIEluIGEgcHJldmlvdXMgcHJv
amVjdCB3aGVyZSB3ZQ0Kd2VyZSBtaWdyYXRpbmcgTklTIHRvIEFELCB3ZSB1c2VkIGRpc3BsYXlO
YW1lIHRvIGhvbGQgdGhlIGNvbnRlbnRzIG9mIHRoZQ0KZ2Vjb3MgZmllbGQsIGFuZCB0aGF0IGlz
IHdoYXQgc3dheWVkIG15IGNob2ljZSBvZiBpbmV0T3JnUGVyc29uIGhlcmUuDQoNCj4gDQo+IHBv
c2l4R3JvdXAgLyBwb3NpeEdyb3VwQWNjb3VudA0KPiANCj4gWC41MjEgZ3JvdXBPZk5hbWVzIHNl
ZW1zIGxpa2UgYSBtb3JlIGFwcHJvcHJpYXRlIGJhc2lzIGZvciB0aGUgZGVmaW5pdGlvbiBvZiBh
IGdyb3VwLg0KDQpCdXQgdGhhdCBkb2Vzbid0IGFsbG93IGZvciBHSUQgbnVtYmVyLg0KDQo+IA0K
PiBlbjogIFNlZSBhYm92ZS4NCg0KUmVwbHkgYWJvdmUuDQoNCj4gDQo+IGV4YWN0VXNlcjogIFRp
ZXMgaW50byB0aGUgY2FzZS1zZW5zaXRpdml0eSBxdWVzdGlvbi4gIElmIGNhc2UtaW5zZW5zaXRp
dmUsICJtZW1iZXJVaWQiIGlzIHJlYXNvbmFibHkNCj4gYXBwcm9wcmlhdGUsIGJlY2F1c2UgaW4g
dGhlIExEQVAgd29ybGQgInVpZCIgbWVhbnMgImxvZ2luIG5hbWUiLg0KDQoidWlkIiBtZWFuaW5n
ICJsb2dpbiBuYW1lIiBpcyBhIHJlYWxseSBiYWQgY2hvaWNlLiAgSSd2ZSBhbHdheXMgdGhvdWdo
dCB0aGF0LCBhbmQgSSd2ZSBwdXNoZWQgdG8gZ2V0DQphd2F5IGZyb20gaXQgaW4gREJJUy4gIFVJ
RCBpcyBhIG51bWJlciwgaXQgc2hvdWxkIGFsd2F5cyBiZSBhIG51bWJlciwgd2h5IGFueW9uZSB0
aG91Z2h0IGl0IHdvdWxkDQpiZSBhIGdvb2QgaWRlYSBmb3IgdGhhdCB0byBhY3R1YWxseSBiZSBh
IG5hbWUgZXNjYXBlcyBtZS4gIEkndmUgZGlzY3Vzc2VkIHRoZSBjYXNlIHNlbnNpdGl2aXR5DQpp
c3N1ZSBhbHJlYWR5LCBhbmQgSSBjYWxsZWQgdGhpcyAiZXhhY3RVc2VyIiB0byBmb2xsb3ctb24g
ZnJvbSB0aGUgaWRlYSBvZiBleGFjdCBjYXNlLCBhbmQgdG8NCmZvbGxvdyBhIHNpbWlsYXIgbGlu
ZSBhcyAiZXhhY3ROYW1lIiAoZW4pLg0KDQo+DQo+IG1hbmFnZXI6ICBhbHRob3VnaCBub3QgaW5h
cHByb3ByaWF0ZSwgWC41MjAgIm93bmVyIiBzZWVtcyBtb3JlIGFwcHJvcHJpYXRlLiAgKEFuZCBu
b3RlIHRoYXQNCj4gZ3JvdXBPZk5hbWVzIGluY2x1ZGVzICJvd25lciIuKQ0KDQpBcyAibWFuYWdl
ciIgd2FzIGFscmVhZHkgaW4gUkZDMjMwNy8yMzA3YmlzIGZvciBob3N0IGFuZCBuZXR3b3JrIGVu
dHJpZXMsIEkganVzdCBleHBhbmRlZA0KdGhlIHN1cHBvcnQgdG8gbWFueSBvdGhlciBlbnRyaWVz
LCBhcyBpdCBzZWVtZWQgYSBzZW5zaWJsZSB0aGluZyB0byBkby4gIEhhdmluZyBzb21lIGVudHJp
ZXMNCnVzZSAib3duZXIiIGFuZCBzb21lIHVzZSAibWFuYWdlciIgd291bGQgYmUgd3JvbmcsIHJl
bW92aW5nICJtYW5hZ2VyIiBmcm9tDQpob3N0IGFuZCBuZXR3b3JrIGVudHJpZXMgd291bGQgYWRk
IGFuIHVubmVjZXNzYXJ5IHN0ZXAgd2hlbiBtaWdyYXRpbmcgZnJvbSBhbiBSRkMyMzA3DQp0byBh
IERCSVMgc2NoZW1hLCBhbmQgYWxsb3dpbmcgYm90aCAib3duZXIiIGFuZCAibWFuYWdlciIgc2Vl
bXMgZXhjZXNzaXZlLg0KDQo+DQo+IG5pc05ldGdyb3VwIC8gbmV0Z3JvdXBPYmplY3QNCj4gDQo+
IEFsdGhvdWdoIG5vdCBhIHBlcmZlY3QgbWF0Y2gsIGdyb3VwT2ZOYW1lcyBzZWVtcyBsaWtlIGl0
IG1pZ2h0IGJlIGEgYmV0dGVyIGJhc2lzIGZvcg0KPiBncm91cGluZyBjb21wdXRlcnMuDQoNCm5l
dGdyb3VwcyBhcmUgYSBzcGVjaWZpYyBjb25zdHJ1Y3QsIHRyeWluZyB0byBzcXVlZXplIHRoZW0g
aW50byBzb21ldGhpbmcgZWxzZSB0aGF0IGlzDQpub3QgYSBwZXJmZWN0IG1hdGNoIHdvdWxkIGJl
IGEgc3Vib3B0aW1hbCBkZWNpc2lvbi4gIExEQVAgY2FuIHJlcHJlc2VudCBuZXRncm91cA0KZGF0
YSBiZXR0ZXIsIHNvIGxldCdzIHJlcHJlc2VudCBpdCBiZXR0ZXIuDQoNCj4NCj4gQWxsIG9mIHRo
ZSBjaGFuZ2VzIGhlcmUgc2VlbSB0byByZWxhdGUgdG8gaXNzdWVzIGRlc2NyaWJlZCBhYm92ZS4N
Cj4gDQo+IGlwU2VydmljZSAvIGlwU2VydmljZU9iamVjdA0KPiBpcFByb3RvY29sIC8gaXBQcm90
b2NvbE9iamVjdA0KPiANCj4gVGhlIGNoYW5nZXMgaGVyZSBhbGwgYXBwZWFyIHRvIGJlIHNpbWls
YXIgdG8gdGhvc2UgZGVzY3JpYmVkIGFib3ZlLCB3aXRoIHRoZSBub3RlIHRoYXQgY2FzZQ0KPiBz
ZW5zaXRpdml0eSBoZXJlIHNlZW1zIGVzcGVjaWFsbHkgcG9pbnRsZXNzLg0KDQpOb3QgYXQgYWxs
IHBvaW50bGVzcyBnaXZlbiB0aGF0IHdlIGhhdmUgcmVhbCB3b3JsZCBleGFtcGxlcyBvZiBzZXJ2
aWNlIG5hbWVzLA0Kb25lIGluIHVwcGVyY2FzZSwgb25lIGluIGxvd2VyY2FzZSwgd2hpY2ggaGF2
ZSB0d28gZGlmZmVyZW50IHBvcnQgbnVtYmVycyBhc3NpZ25lZC4NCklmIERCSVMgZGlkIG5vdCBo
YXZlIGFuIGFuc3dlciB0byB0aGF0LCB3ZSdkIGJlIGJhY2sgdG8gdXNpbmcgYSBjdXN0b20gc2No
ZW1hLA0Kd2hpY2ggZGVmZWF0cyB0aGUgb2JqZWN0IG9mIHRoZSBleGVyY2lzZS4gIE5JUyB3YXMg
Y2FzZSBzZW5zaXRpdmUsIERCSVMgYWltcyB0byBiZQ0KMTAwJSBjb21wYXRpYmxlIHdpdGggdGhl
IE5JUyBzY2hlbWEsIGFzIHByZXZpb3VzbHkgZGlzY3Vzc2VkLg0KDQo+IA0KPiBvbmNScGMgLyBy
cGNPYmplY3QNCj4gDQo+IE9OQyBSUEMgaXMgb25seSBvbmUga2luZCBvZiBSUEMsIHNvIGxlYXZp
bmcgIk9OQyIgaW4gaXRzIG5hbWUgc2VlbXMgYXBwcm9wcmlhdGUuDQoNClJGQzU1MzEgaXMgdGl0
bGVkICJSUEMiIG5vdCAiT05DIFJQQyIsIGFuZCB0aGVyZSBpcyBubyBvdGhlciB0eXBlIG9mIFJQ
QyBkZWZpbmVkIGluIGFuDQpSRkMgYXMgZmFyIGFzIEkgYW0gYXdhcmUuICBUbyBtZSBpdCB3YXMg
b2J2aW91cyB3aGF0IFJQQyByZWZlcnJlZCB0by4gIEkgbmVlZGVkIGEgbmV3DQpjbGFzcyBhbnl3
YXksIGFuZCBjYWxsaW5nIGl0IG9uY1JwY09iamVjdCBzZWVtZWQgdW5uZWNlc3Nhcnkgd2hlbiBy
cGNPYmplY3Qgd2FzDQpjbGVhciBlbm91Z2guDQoNCj4gDQo+IEFnYWluLCB0aGUgY2hhbmdlcyBo
ZXJlIGFsbCBhcHBlYXIgc2ltaWxhciB0byB0aG9zZSBhYm92ZS4NCj4gDQo+IGlwSG9zdCAvIGlw
SG9zdE9iamVjdA0KPiANCj4gVGhpcyBzY2hlbWEgZG9lc24ndCBzZWVtIHRvIGFsbG93IGZvciBh
IGhvc3QgdGhhdCBoYXMgYm90aCBJUHY0IGFuZCBJUHY2IGFkZHJlc3Nlcywgbm9yIGZvciBvbmUN
Cj4gdGhhdCBoYXMgbm8gYWRkcmVzc2VzLg0KDQpNaXhpbmcgSVB2NCBhbmQgSVB2NiBzaG91bGQg
anVzdCBiZSBhIGNhc2Ugb2YgYXNzaWduaW5nIGJvdGggdGhlIGlwdjRIb3N0T2JqZWN0IGFuZCBp
cHY2SG9zdE9iamVjdA0KY2xhc3NlcyB0byB0aGUgc2FtZSBlbnRyeS4gIEEgaG9zdCB3aXRoIG5v
IElQIGFkZHJlc3MsIGlmIHdlIG5lZWQgdG8gc3VwcG9ydCB0aGF0LCBJIHN1Z2dlc3QNCndlIGNo
YW5nZSBpcEhvc3RPYmplY3QgdG8gYmUgU1RSVUNUVVJBTCByYXRoZXIgdGhhbiBBQlNUUkFDVC4N
Cg0KPiANCj4gV2hpbGUgSSBjb3VsZCBzZWUgdXNpbmcgYW4gTERBUCBkaXJlY3RvcnkgYXMgdGhl
IGJhY2sgZW5kIGZvciBhIEROUyBzZXJ2ZXIsIEkgY291bGQgbm90IHNlZSB1c2luZw0KPiBpdCBh
cyB0aGUgY2xpZW50J3MgcHJpbWFyeSBzb3VyY2UgZm9yIGFkZHJlc3M8LT5uYW1lIG1hcHBpbmcu
ICANCj4gSW4gZmFjdCwgcmlwcGluZyB0aGF0IGNhcGFiaWxpdHkgb3V0IG9mIG91ciBMREFQIHN1
cHBvcnQgaXMgb24gbXkgbGlzdCBvZiB0aGluZ3MgdG8gZG8gLSBpdCBhZGRzIGVzc2VudGlhbGx5
DQo+IHplcm8gdmFsdWUgYW5kIG9jY2FzaW9uYWxseSBjYXVzZXMgcHJvYmxlbXMuDQoNCkkgYWdy
ZWUsIGJ1dCBEQklTIG11c3QgYmUgYmFja3dhcmRzIGNvbXBhdGlibGUuDQoNCj4gDQo+IGlwTmV0
d29yay9pcE5ldHdvcmtPYmplY3QNCj4gDQo+IEFzIGFib3ZlLg0KPiANCj4gYXV0b21vdW50TWFw
IC8gQXV0b21vdW50TWFwT2JqZWN0DQo+IA0KPiBBcyBhYm92ZS4NCj4gDQo+IGF1dG9tb3VudCAv
IGF1dG9tb3VudEVudHJ5DQo+IA0KPiBJZiB3ZSdyZSBnb2luZyB0byBjaGFuZ2UgZGVmaW5pdGlv
bnMsIHdlIHNob3VsZCBlbnN1cmUgdGhhdCB0aGUgbmV3IGRlZmluaXRpb24gYWxsb3dzIGZvciBT
TUINCj4gcmVmZXJlbmNlcyBpbiBhZGRpdGlvbiB0byBORlMgcmVmZXJlbmNlcy4gVGhhdCBzdWdn
ZXN0cyBhIFVSTCBmb3JtLg0KDQpJIGFjdHVhbGx5IGFkZGVkIGF1dG9tb3VudE1hcFR5cGUgdG8g
dGhlIGRyYWZ0IGJ1dCBkaWRuJ3QgdXBkYXRlIHRoZSBjb21wYXJpc29uIHRhYmxlLg0KVGhpcyB3
YXMgc28gdGhhdCB3ZSBjb3VsZCBhbHNvIHN1cHBvcnQgYW1kLXN0eWxlIGVudHJpZXMuICBJIHN1
cHBvc2UgdGhhdCBpcyB3aGVyZSB3ZQ0KY291bGQgYWxzbyBzdGF0ZSB0aGF0IGVudHJpZXMgd2Vy
ZSBzbWItc3R5bGUgZW50cmllcyB0b28sIGFuZCBwcm92aWRlIGRpZmZlcmVudA0KYXR0cmlidXRl
cyB0aGF0IGFyZSBTTUItZnJpZW5kbHkuDQoNCj4NCj4gTm90ZSB0aGF0IHNwbGl0dGluZyBhdXRv
bW91bnRJbmZvcm1hdGlvbiBpbnRvIGF1dG9tb3VudExvY2F0aW9uIGFuZCBhdXRvbW91bnRPcHRp
b24gbWVhbnMNCj4gdGhhdCB5b3UgY2FuJ3QgaGF2ZSBtdWx0aXBsZSBsb2NhdGlvbnMgd2l0aCBk
aWZmZXJlbnQgb3B0aW9ucy4NCg0KWW91J3JlIHJpZ2h0LCBidXQgd2h5IHdvdWxkIHlvdSBkbyB0
aGF0Pw0KDQo+DQo+IGF1dG9tb3VudE11bHRpDQo+IA0KPiBJIGRvbid0IHlldCB1bmRlcnN0YW5k
IHdoYXQgdGhpcyBjbGFzcyBpcyBmb3IuDQoNCkkndmUgcmVuYW1lZCB0aGlzIHRvIGF1dG9tb3Vu
dE11bHRpTW91bnQgaW4gdGhlIGRyYWZ0IGFuZCBkaWRuJ3QgdXBkYXRlIHRoZSB0YWJsZS4NClRo
aXMgaXMgZm9yIFNvbGFyaXMtc3R5bGUgbXVsdGktbW91bnQgZW50cmllcy4gIEkgdGhpbmsgdGhl
eSdyZSBiZWluZyByZWZlcnJlZCB0byBhcw0KaGllcmFyY2hpY2FsIG1vdW50cyBub3csIGJ1dCBz
ZWUgc29tZSBleGFtcGxlIGVudHJpZXMgaGVyZToNCg0KaHR0cDovL3NvdXJjZWZvcmdlLm5ldC9w
L2RiaXMvd2lraS9NYXAlMjBFbnRyaWVzLw0KDQpCZXN0IHJlZ2FyZHMsDQpNYXJrLg0KDQoNCg0K
DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQpOT1RJQ0U6IE1vcmdhbiBTdGFubGV5IGlzIG5v
dCBhY3RpbmcgYXMgYSBtdW5pY2lwYWwgYWR2aXNvciBhbmQgdGhlIG9waW5pb25zIG9yIHZpZXdz
IGNvbnRhaW5lZCBoZXJlaW4gYXJlIG5vdCBpbnRlbmRlZCB0byBiZSwgYW5kIGRvIG5vdCBjb25z
dGl0dXRlLCBhZHZpY2Ugd2l0aGluIHRoZSBtZWFuaW5nIG9mIFNlY3Rpb24gOTc1IG9mIHRoZSBE
b2RkLUZyYW5rIFdhbGwgU3RyZWV0IFJlZm9ybSBhbmQgQ29uc3VtZXIgUHJvdGVjdGlvbiBBY3Qu
IElmIHlvdSBoYXZlIHJlY2VpdmVkIHRoaXMgY29tbXVuaWNhdGlvbiBpbiBlcnJvciwgcGxlYXNl
IGRlc3Ryb3kgYWxsIGVsZWN0cm9uaWMgYW5kIHBhcGVyIGNvcGllczsgZG8gbm90IGRpc2Nsb3Nl
LCB1c2Ugb3IgYWN0IHVwb24gdGhlIGluZm9ybWF0aW9uOyBhbmQgbm90aWZ5IHRoZSBzZW5kZXIg
aW1tZWRpYXRlbHkuIE1pc3RyYW5zbWlzc2lvbiBpcyBub3QgaW50ZW5kZWQgdG8gd2FpdmUgY29u
ZmlkZW50aWFsaXR5IG9yIHByaXZpbGVnZS4gTW9yZ2FuIFN0YW5sZXkgcmVzZXJ2ZXMgdGhlIHJp
Z2h0LCB0byB0aGUgZXh0ZW50IHBlcm1pdHRlZCB1bmRlciBhcHBsaWNhYmxlIGxhdywgdG8gbW9u
aXRvciBlbGVjdHJvbmljIGNvbW11bmljYXRpb25zLiBUaGlzIG1lc3NhZ2UgaXMgc3ViamVjdCB0
byB0ZXJtcyBhdmFpbGFibGUgYXQgdGhlIGZvbGxvd2luZyBsaW5rOiBodHRwOi8vd3d3Lm1vcmdh
bnN0YW5sZXkuY29tL2Rpc2NsYWltZXJzLiBJZiB5b3UgY2Fubm90IGFjY2VzcyB0aGVzZSBsaW5r
cywgcGxlYXNlIG5vdGlmeSB1cyBieSByZXBseSBtZXNzYWdlIGFuZCB3ZSB3aWxsIHNlbmQgdGhl
IGNvbnRlbnRzIHRvIHlvdS4gQnkgbWVzc2FnaW5nIHdpdGggTW9yZ2FuIFN0YW5sZXkgeW91IGNv
bnNlbnQgdG8gdGhlIGZvcmVnb2luZy4=


From nobody Thu Nov 26 21:40:17 2015
Return-Path: <steven.legg@viewds.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 024A01AC447 for <ldapext@ietfa.amsl.com>; Thu, 26 Nov 2015 21:40:16 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level: 
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RDHcsC-NOOEZ for <ldapext@ietfa.amsl.com>; Thu, 26 Nov 2015 21:40:13 -0800 (PST)
Received: from mail-pa0-x235.google.com (mail-pa0-x235.google.com [IPv6:2607:f8b0:400e:c03::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 922741AC446 for <ldapext@ietf.org>; Thu, 26 Nov 2015 21:40:13 -0800 (PST)
Received: by padhx2 with SMTP id hx2so104492145pad.1 for <ldapext@ietf.org>; Thu, 26 Nov 2015 21:40:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=viewds-com.20150623.gappssmtp.com; s=20150623; h=subject:to:references:cc:from:message-id:date:user-agent :mime-version:in-reply-to:content-type:content-transfer-encoding; bh=G+BmLtkddmZxHa7sRSlEuBPmAzh6sFV98jwUankS+RQ=; b=pQTwMta1Ljo+FQDjdbDEAMky1ptq1rm4w0s4DexNW8Jh4KIOlY3JSKiQcNvaMIXKEU Pdf6BmFLRou+h3VjPjY9wq95R/SD8eIAC98sRlhPbLnfpvV8zhJ+He1xowi11s/xVLUJ E/2kJ0/qzP48dz46Xf979Vx7vOTzvMdbA9d4G+x4M6tUloDWtTGVMeIf84b7Kjmh1lAN t53YogJU3LuXRE+D1juBRfADZQBLi3AW4d+34tnR0fGXwzwxgII9FV+PrWokUU8c+D1Q /RiyQsYHoK9ptXgUBtMMLmuN6mTUshrvwI9C2ufFAFSvEUO+jCI0WBPgj/XpEhQ72XPt QjpQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-type :content-transfer-encoding; bh=G+BmLtkddmZxHa7sRSlEuBPmAzh6sFV98jwUankS+RQ=; b=QM0d0vxyK0MYwBfghRSEPuFzijPRg1FwaZ/Ysxrrd2YTCHuPPHcwNCodyKnnLDeJYv ZQX40M4jLE7z4DGEACZaB06ucqaDZyG+JYgwz/CyilyhdMeMpMOktDRYzMMXaSlQkdUA PHpif50qrPdaF2l7eNLrdeg6vnqtcAJHMVXqYaX7py6lgPMPzQTj7z4wYZJ3CXk/EcLF rKX4LxnNXb0yE9nN3DpQMrV1hxKpXWZ2IsXYH2D+1D14ujAdyXLAxlRuSnvr2Yi9pAU9 Bg/kYWrWeDEIF9TkRxWZfeC7lf/KLml/aWTYFaauCRjY1tMdLRD2E7m1KZYE+1xKEvsp LlRw==
X-Gm-Message-State: ALoCoQlZyB28UCFF9dz7UFDEOaYgqMPkkHgdW/GZy1ZqrtzZPEkHTN8vTqKSjTHRXUhbOY0fUgG1
X-Received: by 10.98.86.92 with SMTP id k89mr45337911pfb.111.1448602813247; Thu, 26 Nov 2015 21:40:13 -0800 (PST)
Received: from [192.168.1.1] (202.164.192.219.static.rev.eftel.com. [202.164.192.219]) by smtp.googlemail.com with ESMTPSA id v64sm30987688pfi.50.2015.11.26.21.40.10 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 26 Nov 2015 21:40:12 -0800 (PST)
To: "Bannister, Mark" <Mark.Bannister@morganstanley.com>, 'Jordan Brown' <Jordan.Brown@oracle.com>
References: <5655E4F0.7030809@oracle.com> <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
From: Steven Legg <steven.legg@viewds.com>
Message-ID: <5657ECB8.1010601@viewds.com>
Date: Fri, 27 Nov 2015 16:40:08 +1100
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/2OKymMTXgqIH8dD5HQLzR-PqQBU>
Cc: "'ldapext@ietf.org'" <ldapext@ietf.org>
Subject: Re: [ldapext] DBIS commentary
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Nov 2015 05:40:16 -0000

Hi Mark & Jordan,

On 26/11/2015 10:01 PM, Bannister, Mark wrote:
[snip]

>> Footnote 1 says that published classes may not be redefined. Although not all changes seem permissible,
>> some changes (e.g. addition of MAY elements) seem like they could be allowed.  Is there a reference for
>> this restriction?  Note that between X.521-1993 and X.521-2012 the TelecommunicationAttributeSet had
>> an attribute deleted.
>
> I haven't looked for a reference to this restriction, I had learned it from seeing previous exchanges
> on the ldapext mailing list with Kurt Zeilenga.  Here is one such exchange, regarding changing the
> schema declaration of 'posixGroup' in RFC2307bis:
>
> https://www.ietf.org/mail-archive/web/ldapext/current/msg02072.html

The rules of extensibility for object classes in X.519-2008, Clause 12.4 say:

     "Optional user attributes may be added to an existing object class without
      assigning a new object identifier."

Removing an attribute isn't covered, so by omission, it isn't allowed.

I don't recall the LDAP specifications having anything specific to say on the
matter, though I suspect the prevailing attitude is that you can't change an
object class without changing the OID.

The teletexTerminalIdentifier attribute was removed from TelecommunicationAttributeSet
because the service and/or the specifications were defunct, but it was a violation
of X.500's own extensibility rules. IMO the attribute should have just been made
obsolete. To get around possible interoperability problems I treat the new object
class definitions minus teletexTerminalIdentifier as the "original" definitions so
if I encounter a definition that includes teletexTerminalIdentifier it looks like
an allowed extension to the object class.

[snip]

Regards,
Steven


From nobody Fri Nov 27 07:06:48 2015
Return-Path: <idra@samba.org>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F05C1B34EE for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 07:06:47 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.286
X-Spam-Level: 
X-Spam-Status: No, score=-2.286 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.585, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wukU2UcAwpTJ for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 07:06:45 -0800 (PST)
Received: from hr2.samba.org (hr2.samba.org [IPv6:2a01:4f8:192:486::147:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 960A01B34EA for <ldapext@ietf.org>; Fri, 27 Nov 2015 07:06:45 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org;  s=42627210;  h=Date:To:From:Message-ID; bh=C+/709jDY2zf95L2V2qC3Ckv7eM28AfjQq3e3OUdoIE=; b=szDBNrLUkk+n8OBxA8urmLLLUPeTW+OBNQmA/wgwCn1atH3Hbo4AtUxJ38ZEs/mu136sVK/Ewat7S2kuJeVLmft8k7TxsicdJrK05njzvMPmcM72khmLnudCNyzQZ/bv0h8R5oFBovWjlJIcm3qionFzspYYF7L0dQJxl3zXGZM=;
Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim) id 1a2Kbn-0001mF-J1; Fri, 27 Nov 2015 15:06:47 +0000
Message-ID: <1448636792.4732.32.camel@samba.org>
From: Simo Sorce <idra@samba.org>
To: Michael =?ISO-8859-1?Q?Str=F6der?= <michael@stroeder.com>, Petr Spacek <pspacek@redhat.com>, ldapext@ietf.org
Date: Fri, 27 Nov 2015 10:06:32 -0500
In-Reply-To: <5655D502.8080103@stroeder.com>
References: <565478FA.6050502@stroeder.com> <5655C3A9.2040402@redhat.com> <5655D502.8080103@stroeder.com>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.5 (3.16.5-3.fc22) 
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/0ScgPonMQ20gQZcOpFZcnTO9Mcg>
Subject: Re: [ldapext] OATH-LDAP as ldapext WG item?
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Nov 2015 15:06:47 -0000

On Wed, 2015-11-25 at 16:34 +0100, Michael StrĂśder wrote:
> Petr Spacek wrote:
> > On 24.11.2015 15:49, Michael StrĂśder wrote:
> > > HI!
> > > 
> > > Anyone here interested in co-authoring an I-D describing OATH
> > > -LDAP (presented
> > > at LDAPcon 2015)?
> > > 
> > > Is there general interest to add this as ldapext WG item?
> > > 
> > > I have a schema for HOTP/TOTP (see attachment) and a reference
> > > implementation
> > > for HOTP and some thoughts on operational considerations. TOTP
> > > schema might
> > > need some small work and I have to adapt the implementation.
> > 
> > You might be interested in HOTP/TOTP implementation which is
> > available in
> > FreeIPA project. It is available in Fedora 22+ and CentOS 7.1+.
> > 
> > Related LDAP schema is on:
> > http://www.freeipa.org/page/V4/OTP/Schema
> > 
> > Feature design is on:
> > http://www.freeipa.org/page/V4/OTP
> 
> I already know this and I expected you to point me at it. ;-)
> 
> But I decided not to use it. Especially my aim is to define a non
> -proprietary
> approach useful for different vendors.

I'd be interested in understanding your point of view on what's
proprietary or not appropriate in the OTP schema FreeIPA uses.

We've put a lot of thought on how to deal with things like multimaster
replication and so on bu we'd like to improve if you see any
deficiency.

Simo.


From nobody Fri Nov 27 07:06:59 2015
Return-Path: <idra@samba.org>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09DBB1B34EE for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 07:06:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.586
X-Spam-Level: 
X-Spam-Status: No, score=-2.586 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.585, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PZFk691xJAnS for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 07:06:48 -0800 (PST)
Received: from hr2.samba.org (hr2.samba.org [IPv6:2a01:4f8:192:486::147:1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 334CF1B34EA for <ldapext@ietf.org>; Fri, 27 Nov 2015 07:06:48 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org;  s=42627210;  h=Date:Cc:To:From:Message-ID; bh=5/oCoOe55p7RN9C5QjjIGN/UX1W9FRp+1SxMmPhy77Y=;  b=ZH0tRTLandsFTWEAWGxfYrKKqcgqr41xboYa7bYcNkCEA1pK11bxzOuyzcWqiFAG8ARGDvffDt47Rs0Qr5vZXwWa15CNt9vqXAcJji9SoeKQfjaro58t3Y6jxvpWZ3p9Xpemd5xMyC68rdq5WwtCckZF51lYvE7qB2MpB07xi0g=;
Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim) id 1a2Kbr-0001mQ-2g; Fri, 27 Nov 2015 15:06:51 +0000
Message-ID: <1448636802.4732.33.camel@samba.org>
From: Simo Sorce <idra@samba.org>
To: "Bannister, Mark" <Mark.Bannister@morganstanley.com>, 'Jordan Brown' <Jordan.Brown@oracle.com>
Date: Fri, 27 Nov 2015 10:06:42 -0500
In-Reply-To: <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
References: <5655E4F0.7030809@oracle.com> <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.5 (3.16.5-3.fc22) 
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/3e-quKUAtsT51KdP8-ijBmWZlJQ>
Cc: "'ldapext@ietf.org'" <ldapext@ietf.org>
Subject: Re: [ldapext] DBIS commentary
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Nov 2015 15:06:55 -0000

On Thu, 2015-11-26 at 11:01 +0000, Bannister, Mark wrote:
> ďťżHi Jordan,
> 
> This is all excellent feedback, thanks, I really appreciate the time
> you have taken to provide your
> comments.  Many of the points you raise I did spend a long time
> considering myself when I was
> writing the internet drafts, so I hope to provide you with more
> insight into my rationale and why
> I decided to do things the way I did.
> 
> I hope you don't mind but I'm copying it to the ldapext mailing list,
> so that others can also
> comment if they wish.  For others, Jordan is commenting from the
> DBIS/RFC2307
> schema comparison and not directly from the internet drafts:
> 
> http://sourceforge.net/p/dbis/wiki/DBIS%20and%20RFC2307%20schemas/
> 
> Jordan Brown wrote:
> > High-level comments:
> > - In general, our direction is towards X.500 compatibility and
> > Active Directory compatibility.  I would
> >   resist new mechanisms that duplicate those.
> > - As noted in more detail below, I consider case-insensitive
> > processing to be the correct direction and
> >   would resist moves towards case sensitivity.
> > - Some of the mechanisms here (e.g. gecos mapping) seem to
> > duplicate RFC 4876 profiles.
> 
> Thanks for the summary, I'll answer these points individually as I
> get to them below.
> 
> > 
> > Footnote 1 says that published classes may not be redefined.
> > Although not all changes seem permissible,
> > some changes (e.g. addition of MAY elements) seem like they could
> > be allowed.  Is there a reference for
> > this restriction?  Note that between X.521-1993 and X.521-2012 the
> > TelecommunicationAttributeSet had
> > an attribute deleted.
> 
> I haven't looked for a reference to this restriction, I had learned
> it from seeing previous exchanges
> on the ldapext mailing list with Kurt Zeilenga.  Here is one such
> exchange, regarding changing the
> schema declaration of 'posixGroup' in RFC2307bis:
> 
> https://www.ietf.org/mail-archive/web/ldapext/current/msg02072.html
> 
> > 
> > posixAccount / posixUserAccount
> > 
> > en:  I consider the change from a case-sensitive name in NIS to a
> > case-insensitive name in LDAP to be an
> > improvement that should not be reversed.  It is telling that (a)
> > there are no cases in the industry other
> > than UNIX user names where user names are case sensitive, (b) that
> > there are numerous examples in
> > the industry of treating the left side of an e-mail address as case
> > -insensitive, and (c) the X.520 "name"
> > attribute, the base attribute for all naming, is case-insensitive.
> 
> NIS was case sensitive.  That led some firms to put entries in
> various maps that were the same except
> for case.  I have examples here where this occurs in the passwd,
> group, netgroup and services maps.
> Changing these entries would be a) very difficult indeed to the point
> of insurmountable as they've
> been ingrained in many systems in a very large enterprise for over a
> decade and b) unnecessary had
> the RFC2307 schema been 100% backwards compatible with NIS.

NIS was just a poor job of taking the passwd and group files and
reproducing them verbatim in a networked environment, and it badly at
it.
Case sensitive names is something that may be wanted by some legacy
environments, but it is really a bad idea in modern environments and
should be discouraged.
I firmly believe you could have a way to allow case-sensitive names,
but insensitive names should be the default and recommended way, I
fully agree with Jordan on this.

Usernames are used by *users*, not just by machines, and most users
(and admins) will consider the Mark and mark to be the same thing, and
rightly so, it is. Any system that allows you to have two users with
substantially the same name is a failure and a security issue waiting
to happen, so that should not be encouraged.


>   I explain this rationale further in my
> DBIS paper:
> 
> http://ldapcon.org/2015/wp-content/uploads/2015/09/DBIS-Paper-2015.pd
> f
> 
> We had a few choices.  The one which we used for the past few years
> was to define our own custom
> schema.  We had to invent three new custom attributes and seven new
> custom object classes to
> get around this limitation.  It infuriated me that we couldn't use
> RFC2307 out-of-the-box because it
> was not 100% compatible with the NIS schema, and this was one of the
> primary driving forces
> behind me starting DBIS.
> 
> DBIS is my stake in the ground to say we MUST solve this problem.  I
> hear what you're saying,
> but your arguments for case insensitivity disregard that UNIX is
> primarily a case-sensitive
> operating system and that NIS was also case-sensitive.  Frankly, as
> RFC2307 was supposed to
> be primarily getting NIS data into LDAP, it failed tremendously by
> bending to the Windows/AD
> case insensitivity preferences.  UNIX will not change.  It will
> always be case sensitive.  Therefore
> we need an LDAP schema that will respect that.

Unix passwd files are case sensitive, that doesn't mean LDAP has to be
at all. If you have the right pam/nss modules you can definitely behave
in both case preserving or case insensitive ways easily, and the Unix
system will not care. The kernel cares only about uidNumber/gidNumber
and names are just a representation.
There are unfortunately people that code their applications in a way
that user user/group names fro access control without first resolving
them to their numeric identifier, those are already broken wrt renames,
and may be broken if you return a random case from nsswitch plugins,
but you do not have to return a random case from a nsswitch plugin you
can simply always return all lowercase and your system is perfectly
consistent then.

Proof is that we've been using case-insensitive setups for more than a
decade (both LDAP, and Samba/Windows based source of user information)
and it works in 99.9% of setups.

> I hope this doesn't mean we end up with one schema for UNIX and one
> for Windows, perhaps
> we can be creative, for example, encouraging Windows software to
> force all characters to
> lowercase before adding entries to LDAP and constructing search
> filters, although this will
> probably be prone to breakage.

Any new schema for LDAP that insist on being only case sensitive is
simply broken and cannot be a standard IMHO.

>   Or perhaps we can define some special attributes where case
> is handled differently depending on the capability of the client.

A schema that allows to define sensitivity *may* work, depending on the
details.

>   If the client claims it is
> case sensitive, these special attributes are handled case
> sensitively, and vice versa if the client
> claims it is case insensitive.  I see case sensitivity as an issue
> that will prevail forever, in the
> same way that endianness will differ between architectures; they will
> never converge and
> so we should not be accepting standards that do not provide a
> solution for both types.

Not sure about that, we have experience that unix/linux system can work
just fine with case insensitive user names, only some broken/legacy
setup cannot cope because of existing broken data, but that is not a
Unix issue, it is a specific deployment issue. It is ok to let those
deployments have an option perhaps (I think they are just broken on
security grounds, but that's just my opinion) but I think your
characterization that Unix/Liunux clients can only cope with case
sensitive names is misleading, given we have experience that they can
cope just fine assuming the nsswitch and pam module used are properly
built to deal with that.

> > 
> > authPassword:  Imported from RFC2307bis-02 and thence from RFC
> > 3112.  Partially, but only partially,
> > duplicates userPassword (from X.509 via RFC2307).  Appears to
> > completely duplicate userPwd (also
> > from X.509).  May also duplicate encryptedUserPassword, mentioned
> > in X.520 but not defined
> > anywhere that I can find.
> 
> I added authPassword simply because I wanted those using RFC2307bis
> to be able to migrate
> seamlessly to DBIS.  I made it clear in the drafts that there are
> better and more secure ways to store
> passwords and these should be used in preference - authPassword was
> provided for backwards
> compatibility only.
> 
> If you have an issue with authPassword being in RFC2307bis, now is
> the time to raise it, as it
> is on the new LDAPEXT charter and the WG are planning to finalise
> RFC2307bis in the
> next 12 months and give it its own RFC number.

I have the issue that in 2015 we cannot propose standards that assume
password hashes are distributed outside of the directory, and that
password storage should definitely be an implementation detail (it can
be standardized, but not necessarily with an identity information
standard). Clients should just use ldap binds and let the LDAP server
handle internally how authentication is handled (may not be a password
at all).

> > gecos:  Removed in DBIS with no explicit replacement.  DBIS
> > recommends using its mapping capabilities
> > to map gecos onto some other attribute, e.g. displayName.  While
> > eliminating gecos seems desirable
> > (as an unnecessarily UNIX-specific attribute), it seems desirable
> > to explicitly specify a replacement
> > rather than to rely on custom mapping.  (Note also that some
> > implementations have encoded
> > additional information, e.g. telephone number, into the gecos
> > field.  This seems like an undesirable
> > overloading of the schema.)
> 
> LDAP is so much better at representing all kinds of random
> information than NIS was, and the passwd
> flat-text file.  Just because there was a random "throw in any
> information you like" including an
> implied encouragement in Sun Microsystems' training courses to
> include telephone information
> in the gecos field, does not mean that when you move to a much more
> structured system such
> as LDAP you have to keep the general purpose nonsense.  If you want
> to encode a telephone number, 
> there is an attribute for that.  If you want a surname, or a first
> name, there are attributes for that
> too.  "Gecos" is not a unique piece of information, it is a container
> for an assortment of data, which
> will differ from one firm to the next.  The equivalent to "gecos" is
> an LDAP object.

I tend to agree with this sentiment.

> > 
> > description:  Removed from explicit mention in DBIS, but inherited
> > from Person if inetOrgPerson is
> > used as the base class.  Not clear how it fits into the UNIX/NIS
> > schema.
> 
> I removed it because I saw no purpose for it on a passwd entry, and
> as you say you can get it
> back again if you include another auxiliary class which you probably
> want to do
> anyway to have something to map gecos to.
> 
> > 
> > Structural User Account:  changes from "account" (RFC 4524) to
> > "inetOrgPerson" 
> > (RFC 2798).  While this is an obvious simplification, it does not
> > seem correct.  
> > An account may be associated with more than one person, and one
> > person may be associated with
> > more than one account.  (However, associating it with "account" 
> > leaves it unclear where to collect a gecos/display name, except
> > perhaps
> > "description".)
> 
> Quite, "account" doesn't have a field where you can sensibly put the
> descriptive
> name of the user, whereas inetOrgPerson does.  In a previous project
> where we
> were migrating NIS to AD, we used displayName to hold the contents of
> the
> gecos field, and that is what swayed my choice of inetOrgPerson here.
> 
> > 
> > posixGroup / posixGroupAccount
> > 
> > X.521 groupOfNames seems like a more appropriate basis for the
> > definition of a group.
> 
> But that doesn't allow for GID number.
> 
> > 
> > en:  See above.
> 
> Reply above.
> 
> > 
> > exactUser:  Ties into the case-sensitivity question.  If case
> > -insensitive, "memberUid" is reasonably
> > appropriate, because in the LDAP world "uid" means "login name".
> 
> "uid" meaning "login name" is a really bad choice.  I've always
> thought that, and I've pushed to get
> away from it in DBIS.  UID is a number, it should always be a number,
> why anyone thought it would
> be a good idea for that to actually be a name escapes me.  I've
> discussed the case sensitivity
> issue already, and I called this "exactUser" to follow-on from the
> idea of exact case, and to
> follow a similar line as "exactName" (en).
> 
> > 
> > manager:  although not inappropriate, X.520 "owner" seems more
> > appropriate.  (And note that
> > groupOfNames includes "owner".)
> 
> As "manager" was already in RFC2307/2307bis for host and network
> entries, I just expanded
> the support to many other entries, as it seemed a sensible thing to
> do.  Having some entries
> use "owner" and some use "manager" would be wrong, removing "manager"
> from
> host and network entries would add an unnecessary step when migrating
> from an RFC2307
> to a DBIS schema, and allowing both "owner" and "manager" seems
> excessive.

Actually owner and manager are quite different concepts, and allowing
both would not be bad idea.

> > 
> > nisNetgroup / netgroupObject
> > 
> > Although not a perfect match, groupOfNames seems like it might be a
> > better basis for
> > grouping computers.
> 
> netgroups are a specific construct, trying to squeeze them into
> something else that is
> not a perfect match would be a suboptimal decision.  LDAP can
> represent netgroup
> data better, so let's represent it better.

Netgroups are an abomination that should die. People should migrate off
of them, and we should not encode that abomination into a new standard
in 2015. This is one of the things that have me opposed to DBIS as a
standard, leave netgroups to RFC2307 and let them die there.

> > 
> > All of the changes here seem to relate to issues described above.
> > 
> > ipService / ipServiceObject
> > ipProtocol / ipProtocolObject
> > 
> > The changes here all appear to be similar to those described above,
> > with the note that case
> > sensitivity here seems especially pointless.
> 
> Not at all pointless given that we have real world examples of
> service names,
> one in uppercase, one in lowercase, which have two different port
> numbers assigned.
> If DBIS did not have an answer to that, we'd be back to using a
> custom schema,
> which defeats the object of the exercise.  NIS was case sensitive,
> DBIS aims to be
> 100% compatible with the NIS schema, as previously discussed.

NIS is dead Jim, dead! :-)

New standards should define stuff useful for the future, not backward
looking stuff that encodes and encroach mistakes done in the past.

For people that needs backwards compat with NIS what you should do is
simply define a generic NIS MAP object, and let individual sites store
what they want on these "maps" including crusty old concepts that
nobody should uses any more like the services and rpc maps.

> > oncRpc / rpcObject
> > 
> > ONC RPC is only one kind of RPC, so leaving "ONC" in its name seems
> > appropriate.
> 
> RFC5531 is titled "RPC" not "ONC RPC", and there is no other type of
> RPC defined in an
> RFC as far as I am aware.  To me it was obvious what RPC referred to.
>   I needed a new
> class anyway, and calling it oncRpcObject seemed unnecessary when
> rpcObject was
> clear enough.
> 
> > 
> > Again, the changes here all appear similar to those above.
> > 
> > ipHost / ipHostObject
> > 
> > This schema doesn't seem to allow for a host that has both IPv4 and
> > IPv6 addresses, nor for one
> > that has no addresses.
> 
> Mixing IPv4 and IPv6 should just be a case of assigning both the
> ipv4HostObject and ipv6HostObject
> classes to the same entry.  A host with no IP address, if we need to
> support that, I suggest
> we change ipHostObject to be STRUCTURAL rather than ABSTRACT.
> 
> > 
> > While I could see using an LDAP directory as the back end for a DNS
> > server, I could not see using
> > it as the client's primary source for address<->name mapping.  
> > In fact, ripping that capability out of our LDAP support is on my
> > list of things to do - it adds essentially
> > zero value and occasionally causes problems.

Amen

> I agree, but DBIS must be backwards compatible.

For you it may be, but from a Standards body it is not necessarily the
case, if your "proposal" is also "unchangeable" then there is no
discussion to be had in this group, no discussion, means also no
standard though (IMHO). As standards in IETF come from at least rough
consensus and here I do not see much consensus nor a willingness to
accept other points of view.


Simo.


> > 
> > ipNetwork/ipNetworkObject
> > 
> > As above.
> > 
> > automountMap / AutomountMapObject
> > 
> > As above.
> > 
> > automount / automountEntry
> > 
> > If we're going to change definitions, we should ensure that the new
> > definition allows for SMB
> > references in addition to NFS references. That suggests a URL form.
> 
> I actually added automountMapType to the draft but didn't update the
> comparison table.
> This was so that we could also support amd-style entries.  I suppose
> that is where we
> could also state that entries were smb-style entries too, and provide
> different
> attributes that are SMB-friendly.
> 
> > 
> > Note that splitting automountInformation into automountLocation and
> > automountOption means
> > that you can't have multiple locations with different options.
> 
> You're right, but why would you do that?
> 
> > 
> > automountMulti
> > 
> > I don't yet understand what this class is for.
> 
> I've renamed this to automountMultiMount in the draft and didn't
> update the table.
> This is for Solaris-style multi-mount entries.  I think they're being
> referred to as
> hierarchical mounts now, but see some example entries here:
> 
> http://sourceforge.net/p/dbis/wiki/Map%20Entries/
> 
> Best regards,
> Mark.
> 
> 
> 
> 
> ---------------------------------------------------------------------
> -----------
> 
> NOTICE: Morgan Stanley is not acting as a municipal advisor and the
> opinions or views contained herein are not intended to be, and do not
> constitute, advice within the meaning of Section 975 of the Dodd
> -Frank Wall Street Reform and Consumer Protection Act. If you have
> received this communication in error, please destroy all electronic
> and paper copies; do not disclose, use or act upon the information;
> and notify the sender immediately. Mistransmission is not intended to
> waive confidentiality or privilege. Morgan Stanley reserves the
> right, to the extent permitted under applicable law, to monitor
> electronic communications. This message is subject to terms available
> at the following link: http://www.morganstanley.com/disclaimers. If
> you cannot access these links, please notify us by reply message and
> we will send the contents to you. By messaging with Morgan Stanley
> you consent to the foregoing.
> _______________________________________________
> Ldapext mailing list
> Ldapext@ietf.org
> https://www.ietf.org/mailman/listinfo/ldapext


From nobody Fri Nov 27 09:36:57 2015
Return-Path: <medievalist@gmail.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE8D51B370E for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 09:36:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.069
X-Spam-Level: 
X-Spam-Status: No, score=0.069 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MALFORMED_FREEMAIL=1.047, MISSING_HEADERS=1.021, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id frchqy8yybu4 for <ldapext@ietfa.amsl.com>; Fri, 27 Nov 2015 09:36:49 -0800 (PST)
Received: from mail-lf0-x231.google.com (mail-lf0-x231.google.com [IPv6:2a00:1450:4010:c07::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4BB721B2C0E for <ldapext@ietf.org>; Fri, 27 Nov 2015 09:36:48 -0800 (PST)
Received: by lffu14 with SMTP id u14so136671484lff.1 for <ldapext@ietf.org>; Fri, 27 Nov 2015 09:36:46 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;  h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=BGL1Mkwz7RrZtNQF2eMWRfUUwAWXB2mA9KxrUFBIbTw=; b=g8y8elhz2J355L8GFbiLixLmgr7N2kwTrWH9w62LZ093MhuYxjaAIx6jTUQEPHvVY6 Uyg8gs6VpW99iymebWQEvSXlvl3jDZbKJNkt2JIaJntKmGTlEVszq54l2R976zQ+ns+8 538ImCsJTHmvVwdNgVwz8NCRSo3B07IwVY5sgvCxdCyz6Bn3o9h5e5YDB8LbLUYWzP0k ixHIRdN03VsTw++7kb7wh5XwAuzytoBhOiFl2rHC1AByG7LBwwMWtmgEG7PF8e5H9igF WjreJOyCTeSaGKnvj+x1EKVA7nAn34BZ5lvnXhiE9F0TN2jCm2uelgPPrXNjSrkZuSlI ezKQ==
MIME-Version: 1.0
X-Received: by 10.25.134.137 with SMTP id i131mr20778272lfd.66.1448645806407;  Fri, 27 Nov 2015 09:36:46 -0800 (PST)
Received: by 10.114.80.193 with HTTP; Fri, 27 Nov 2015 09:36:46 -0800 (PST)
Received: by 10.114.80.193 with HTTP; Fri, 27 Nov 2015 09:36:46 -0800 (PST)
In-Reply-To: <1448636802.4732.33.camel@samba.org>
References: <5655E4F0.7030809@oracle.com> <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com> <1448636802.4732.33.camel@samba.org>
Date: Fri, 27 Nov 2015 12:36:46 -0500
Message-ID: <CAJb3uA44vbxudkRfMPdy-V7WCFSRL87XsNOROD5Z+jVPY3sHRA@mail.gmail.com>
From: Charlie <medievalist@gmail.com>
Cc: ldapext <ldapext@ietf.org>
Content-Type: multipart/alternative; boundary=001a113fb648b24d220525892281
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/1j0M-jrvucqDxMJ1q4EVfw0xrBo>
Subject: Re: [ldapext] DBIS commentary
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Nov 2015 17:36:56 -0000

--001a113fb648b24d220525892281
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Uids have not been numeric since RSTS/E and RSX.  The name is a contraction
of "user identifier" and in Unix they are the first field of the passwd
data object and are intended to be unique keys.  The numeric key associated
with a uid is the uidno or "user identifier NUMBER".

In modern deployments the taxon "login name" is imprecise and not unique; I
can and do "log in" using several different naming conventions (SAMname,
Kerberos principal, or LDAP distinguished name, which are all different)
and all of those identify me to the system as the unique user id keyed by
"uid".  POSIX file systems tag files with uidnos, and these are
just-in-time looked up to determine the user id currently associated with
the uidno.  That abstraction layer lets the names of groups and users be
changed without massive wholesale revision of filesystem metadata,
providing administrative scalability.

Thus, a uid is neither a login name nor a number; when cleanly implemented,
it is a unique alphanumeric key.  This is quite different from the
Microsoft SID-based system, but can be made compatible for most purposes by
making uids and SAMnames identical.

Netgroups are indeed an abomination and I  should rejoice if they were to
disappear.  Beers would be consumed.

Unix was intended by Ritchie et al to be case-sensitive, and significant
implementations exist that assume this.  However, I have converted a medium
sized enterprise (less than 200 named groups) to case insensitivity, by
renaming groups while retaining gidnos, during an LDAP conversion.  It's a
significant effort but nowhere near the complexity of converting to a
shared group and user namespace such as Microsoft AD implements;
duplication of names in the group and user namespaces is commonplace in
linux deployments.

Hoping that this was helpful and I'm not flogging any deceased equines,
--Charlie Brooks
On Nov 27, 2015 10:06 AM, "Simo Sorce" <idra@samba.org> wrote:

> On Thu, 2015-11-26 at 11:01 +0000, Bannister, Mark wrote:
> > =EF=BB=BFHi Jordan,
> >
> > This is all excellent feedback, thanks, I really appreciate the time
> > you have taken to provide your
> > comments.  Many of the points you raise I did spend a long time
> > considering myself when I was
> > writing the internet drafts, so I hope to provide you with more
> > insight into my rationale and why
> > I decided to do things the way I did.
> >
> > I hope you don't mind but I'm copying it to the ldapext mailing list,
> > so that others can also
> > comment if they wish.  For others, Jordan is commenting from the
> > DBIS/RFC2307
> > schema comparison and not directly from the internet drafts:
> >
> > http://sourceforge.net/p/dbis/wiki/DBIS%20and%20RFC2307%20schemas/
> >
> > Jordan Brown wrote:
> > > High-level comments:
> > > - In general, our direction is towards X.500 compatibility and
> > > Active Directory compatibility.  I would
> > >   resist new mechanisms that duplicate those.
> > > - As noted in more detail below, I consider case-insensitive
> > > processing to be the correct direction and
> > >   would resist moves towards case sensitivity.
> > > - Some of the mechanisms here (e.g. gecos mapping) seem to
> > > duplicate RFC 4876 profiles.
> >
> > Thanks for the summary, I'll answer these points individually as I
> > get to them below.
> >
> > >
> > > Footnote 1 says that published classes may not be redefined.
> > > Although not all changes seem permissible,
> > > some changes (e.g. addition of MAY elements) seem like they could
> > > be allowed.  Is there a reference for
> > > this restriction?  Note that between X.521-1993 and X.521-2012 the
> > > TelecommunicationAttributeSet had
> > > an attribute deleted.
> >
> > I haven't looked for a reference to this restriction, I had learned
> > it from seeing previous exchanges
> > on the ldapext mailing list with Kurt Zeilenga.  Here is one such
> > exchange, regarding changing the
> > schema declaration of 'posixGroup' in RFC2307bis:
> >
> > https://www.ietf.org/mail-archive/web/ldapext/current/msg02072.html
> >
> > >
> > > posixAccount / posixUserAccount
> > >
> > > en:  I consider the change from a case-sensitive name in NIS to a
> > > case-insensitive name in LDAP to be an
> > > improvement that should not be reversed.  It is telling that (a)
> > > there are no cases in the industry other
> > > than UNIX user names where user names are case sensitive, (b) that
> > > there are numerous examples in
> > > the industry of treating the left side of an e-mail address as case
> > > -insensitive, and (c) the X.520 "name"
> > > attribute, the base attribute for all naming, is case-insensitive.
> >
> > NIS was case sensitive.  That led some firms to put entries in
> > various maps that were the same except
> > for case.  I have examples here where this occurs in the passwd,
> > group, netgroup and services maps.
> > Changing these entries would be a) very difficult indeed to the point
> > of insurmountable as they've
> > been ingrained in many systems in a very large enterprise for over a
> > decade and b) unnecessary had
> > the RFC2307 schema been 100% backwards compatible with NIS.
>
> NIS was just a poor job of taking the passwd and group files and
> reproducing them verbatim in a networked environment, and it badly at
> it.
> Case sensitive names is something that may be wanted by some legacy
> environments, but it is really a bad idea in modern environments and
> should be discouraged.
> I firmly believe you could have a way to allow case-sensitive names,
> but insensitive names should be the default and recommended way, I
> fully agree with Jordan on this.
>
> Usernames are used by *users*, not just by machines, and most users
> (and admins) will consider the Mark and mark to be the same thing, and
> rightly so, it is. Any system that allows you to have two users with
> substantially the same name is a failure and a security issue waiting
> to happen, so that should not be encouraged.
>
>
> >   I explain this rationale further in my
> > DBIS paper:
> >
> > http://ldapcon.org/2015/wp-content/uploads/2015/09/DBIS-Paper-2015.pd
> > f
> >
> > We had a few choices.  The one which we used for the past few years
> > was to define our own custom
> > schema.  We had to invent three new custom attributes and seven new
> > custom object classes to
> > get around this limitation.  It infuriated me that we couldn't use
> > RFC2307 out-of-the-box because it
> > was not 100% compatible with the NIS schema, and this was one of the
> > primary driving forces
> > behind me starting DBIS.
> >
> > DBIS is my stake in the ground to say we MUST solve this problem.  I
> > hear what you're saying,
> > but your arguments for case insensitivity disregard that UNIX is
> > primarily a case-sensitive
> > operating system and that NIS was also case-sensitive.  Frankly, as
> > RFC2307 was supposed to
> > be primarily getting NIS data into LDAP, it failed tremendously by
> > bending to the Windows/AD
> > case insensitivity preferences.  UNIX will not change.  It will
> > always be case sensitive.  Therefore
> > we need an LDAP schema that will respect that.
>
> Unix passwd files are case sensitive, that doesn't mean LDAP has to be
> at all. If you have the right pam/nss modules you can definitely behave
> in both case preserving or case insensitive ways easily, and the Unix
> system will not care. The kernel cares only about uidNumber/gidNumber
> and names are just a representation.
> There are unfortunately people that code their applications in a way
> that user user/group names fro access control without first resolving
> them to their numeric identifier, those are already broken wrt renames,
> and may be broken if you return a random case from nsswitch plugins,
> but you do not have to return a random case from a nsswitch plugin you
> can simply always return all lowercase and your system is perfectly
> consistent then.
>
> Proof is that we've been using case-insensitive setups for more than a
> decade (both LDAP, and Samba/Windows based source of user information)
> and it works in 99.9% of setups.
>
> > I hope this doesn't mean we end up with one schema for UNIX and one
> > for Windows, perhaps
> > we can be creative, for example, encouraging Windows software to
> > force all characters to
> > lowercase before adding entries to LDAP and constructing search
> > filters, although this will
> > probably be prone to breakage.
>
> Any new schema for LDAP that insist on being only case sensitive is
> simply broken and cannot be a standard IMHO.
>
> >   Or perhaps we can define some special attributes where case
> > is handled differently depending on the capability of the client.
>
> A schema that allows to define sensitivity *may* work, depending on the
> details.
>
> >   If the client claims it is
> > case sensitive, these special attributes are handled case
> > sensitively, and vice versa if the client
> > claims it is case insensitive.  I see case sensitivity as an issue
> > that will prevail forever, in the
> > same way that endianness will differ between architectures; they will
> > never converge and
> > so we should not be accepting standards that do not provide a
> > solution for both types.
>
> Not sure about that, we have experience that unix/linux system can work
> just fine with case insensitive user names, only some broken/legacy
> setup cannot cope because of existing broken data, but that is not a
> Unix issue, it is a specific deployment issue. It is ok to let those
> deployments have an option perhaps (I think they are just broken on
> security grounds, but that's just my opinion) but I think your
> characterization that Unix/Liunux clients can only cope with case
> sensitive names is misleading, given we have experience that they can
> cope just fine assuming the nsswitch and pam module used are properly
> built to deal with that.
>
> > >
> > > authPassword:  Imported from RFC2307bis-02 and thence from RFC
> > > 3112.  Partially, but only partially,
> > > duplicates userPassword (from X.509 via RFC2307).  Appears to
> > > completely duplicate userPwd (also
> > > from X.509).  May also duplicate encryptedUserPassword, mentioned
> > > in X.520 but not defined
> > > anywhere that I can find.
> >
> > I added authPassword simply because I wanted those using RFC2307bis
> > to be able to migrate
> > seamlessly to DBIS.  I made it clear in the drafts that there are
> > better and more secure ways to store
> > passwords and these should be used in preference - authPassword was
> > provided for backwards
> > compatibility only.
> >
> > If you have an issue with authPassword being in RFC2307bis, now is
> > the time to raise it, as it
> > is on the new LDAPEXT charter and the WG are planning to finalise
> > RFC2307bis in the
> > next 12 months and give it its own RFC number.
>
> I have the issue that in 2015 we cannot propose standards that assume
> password hashes are distributed outside of the directory, and that
> password storage should definitely be an implementation detail (it can
> be standardized, but not necessarily with an identity information
> standard). Clients should just use ldap binds and let the LDAP server
> handle internally how authentication is handled (may not be a password
> at all).
>
> > > gecos:  Removed in DBIS with no explicit replacement.  DBIS
> > > recommends using its mapping capabilities
> > > to map gecos onto some other attribute, e.g. displayName.  While
> > > eliminating gecos seems desirable
> > > (as an unnecessarily UNIX-specific attribute), it seems desirable
> > > to explicitly specify a replacement
> > > rather than to rely on custom mapping.  (Note also that some
> > > implementations have encoded
> > > additional information, e.g. telephone number, into the gecos
> > > field.  This seems like an undesirable
> > > overloading of the schema.)
> >
> > LDAP is so much better at representing all kinds of random
> > information than NIS was, and the passwd
> > flat-text file.  Just because there was a random "throw in any
> > information you like" including an
> > implied encouragement in Sun Microsystems' training courses to
> > include telephone information
> > in the gecos field, does not mean that when you move to a much more
> > structured system such
> > as LDAP you have to keep the general purpose nonsense.  If you want
> > to encode a telephone number,
> > there is an attribute for that.  If you want a surname, or a first
> > name, there are attributes for that
> > too.  "Gecos" is not a unique piece of information, it is a container
> > for an assortment of data, which
> > will differ from one firm to the next.  The equivalent to "gecos" is
> > an LDAP object.
>
> I tend to agree with this sentiment.
>
> > >
> > > description:  Removed from explicit mention in DBIS, but inherited
> > > from Person if inetOrgPerson is
> > > used as the base class.  Not clear how it fits into the UNIX/NIS
> > > schema.
> >
> > I removed it because I saw no purpose for it on a passwd entry, and
> > as you say you can get it
> > back again if you include another auxiliary class which you probably
> > want to do
> > anyway to have something to map gecos to.
> >
> > >
> > > Structural User Account:  changes from "account" (RFC 4524) to
> > > "inetOrgPerson"
> > > (RFC 2798).  While this is an obvious simplification, it does not
> > > seem correct.
> > > An account may be associated with more than one person, and one
> > > person may be associated with
> > > more than one account.  (However, associating it with "account"
> > > leaves it unclear where to collect a gecos/display name, except
> > > perhaps
> > > "description".)
> >
> > Quite, "account" doesn't have a field where you can sensibly put the
> > descriptive
> > name of the user, whereas inetOrgPerson does.  In a previous project
> > where we
> > were migrating NIS to AD, we used displayName to hold the contents of
> > the
> > gecos field, and that is what swayed my choice of inetOrgPerson here.
> >
> > >
> > > posixGroup / posixGroupAccount
> > >
> > > X.521 groupOfNames seems like a more appropriate basis for the
> > > definition of a group.
> >
> > But that doesn't allow for GID number.
> >
> > >
> > > en:  See above.
> >
> > Reply above.
> >
> > >
> > > exactUser:  Ties into the case-sensitivity question.  If case
> > > -insensitive, "memberUid" is reasonably
> > > appropriate, because in the LDAP world "uid" means "login name".
> >
> > "uid" meaning "login name" is a really bad choice.  I've always
> > thought that, and I've pushed to get
> > away from it in DBIS.  UID is a number, it should always be a number,
> > why anyone thought it would
> > be a good idea for that to actually be a name escapes me.  I've
> > discussed the case sensitivity
> > issue already, and I called this "exactUser" to follow-on from the
> > idea of exact case, and to
> > follow a similar line as "exactName" (en).
> >
> > >
> > > manager:  although not inappropriate, X.520 "owner" seems more
> > > appropriate.  (And note that
> > > groupOfNames includes "owner".)
> >
> > As "manager" was already in RFC2307/2307bis for host and network
> > entries, I just expanded
> > the support to many other entries, as it seemed a sensible thing to
> > do.  Having some entries
> > use "owner" and some use "manager" would be wrong, removing "manager"
> > from
> > host and network entries would add an unnecessary step when migrating
> > from an RFC2307
> > to a DBIS schema, and allowing both "owner" and "manager" seems
> > excessive.
>
> Actually owner and manager are quite different concepts, and allowing
> both would not be bad idea.
>
> > >
> > > nisNetgroup / netgroupObject
> > >
> > > Although not a perfect match, groupOfNames seems like it might be a
> > > better basis for
> > > grouping computers.
> >
> > netgroups are a specific construct, trying to squeeze them into
> > something else that is
> > not a perfect match would be a suboptimal decision.  LDAP can
> > represent netgroup
> > data better, so let's represent it better.
>
> Netgroups are an abomination that should die. People should migrate off
> of them, and we should not encode that abomination into a new standard
> in 2015. This is one of the things that have me opposed to DBIS as a
> standard, leave netgroups to RFC2307 and let them die there.
>
> > >
> > > All of the changes here seem to relate to issues described above.
> > >
> > > ipService / ipServiceObject
> > > ipProtocol / ipProtocolObject
> > >
> > > The changes here all appear to be similar to those described above,
> > > with the note that case
> > > sensitivity here seems especially pointless.
> >
> > Not at all pointless given that we have real world examples of
> > service names,
> > one in uppercase, one in lowercase, which have two different port
> > numbers assigned.
> > If DBIS did not have an answer to that, we'd be back to using a
> > custom schema,
> > which defeats the object of the exercise.  NIS was case sensitive,
> > DBIS aims to be
> > 100% compatible with the NIS schema, as previously discussed.
>
> NIS is dead Jim, dead! :-)
>
> New standards should define stuff useful for the future, not backward
> looking stuff that encodes and encroach mistakes done in the past.
>
> For people that needs backwards compat with NIS what you should do is
> simply define a generic NIS MAP object, and let individual sites store
> what they want on these "maps" including crusty old concepts that
> nobody should uses any more like the services and rpc maps.
>
> > > oncRpc / rpcObject
> > >
> > > ONC RPC is only one kind of RPC, so leaving "ONC" in its name seems
> > > appropriate.
> >
> > RFC5531 is titled "RPC" not "ONC RPC", and there is no other type of
> > RPC defined in an
> > RFC as far as I am aware.  To me it was obvious what RPC referred to.
> >   I needed a new
> > class anyway, and calling it oncRpcObject seemed unnecessary when
> > rpcObject was
> > clear enough.
> >
> > >
> > > Again, the changes here all appear similar to those above.
> > >
> > > ipHost / ipHostObject
> > >
> > > This schema doesn't seem to allow for a host that has both IPv4 and
> > > IPv6 addresses, nor for one
> > > that has no addresses.
> >
> > Mixing IPv4 and IPv6 should just be a case of assigning both the
> > ipv4HostObject and ipv6HostObject
> > classes to the same entry.  A host with no IP address, if we need to
> > support that, I suggest
> > we change ipHostObject to be STRUCTURAL rather than ABSTRACT.
> >
> > >
> > > While I could see using an LDAP directory as the back end for a DNS
> > > server, I could not see using
> > > it as the client's primary source for address<->name mapping.
> > > In fact, ripping that capability out of our LDAP support is on my
> > > list of things to do - it adds essentially
> > > zero value and occasionally causes problems.
>
> Amen
>
> > I agree, but DBIS must be backwards compatible.
>
> For you it may be, but from a Standards body it is not necessarily the
> case, if your "proposal" is also "unchangeable" then there is no
> discussion to be had in this group, no discussion, means also no
> standard though (IMHO). As standards in IETF come from at least rough
> consensus and here I do not see much consensus nor a willingness to
> accept other points of view.
>
>
> Simo.
>
>
> > >
> > > ipNetwork/ipNetworkObject
> > >
> > > As above.
> > >
> > > automountMap / AutomountMapObject
> > >
> > > As above.
> > >
> > > automount / automountEntry
> > >
> > > If we're going to change definitions, we should ensure that the new
> > > definition allows for SMB
> > > references in addition to NFS references. That suggests a URL form.
> >
> > I actually added automountMapType to the draft but didn't update the
> > comparison table.
> > This was so that we could also support amd-style entries.  I suppose
> > that is where we
> > could also state that entries were smb-style entries too, and provide
> > different
> > attributes that are SMB-friendly.
> >
> > >
> > > Note that splitting automountInformation into automountLocation and
> > > automountOption means
> > > that you can't have multiple locations with different options.
> >
> > You're right, but why would you do that?
> >
> > >
> > > automountMulti
> > >
> > > I don't yet understand what this class is for.
> >
> > I've renamed this to automountMultiMount in the draft and didn't
> > update the table.
> > This is for Solaris-style multi-mount entries.  I think they're being
> > referred to as
> > hierarchical mounts now, but see some example entries here:
> >
> > http://sourceforge.net/p/dbis/wiki/Map%20Entries/
> >
> > Best regards,
> > Mark.
> >
> >
> >
> >
> > ---------------------------------------------------------------------
> > -----------
> >
> > NOTICE: Morgan Stanley is not acting as a municipal advisor and the
> > opinions or views contained herein are not intended to be, and do not
> > constitute, advice within the meaning of Section 975 of the Dodd
> > -Frank Wall Street Reform and Consumer Protection Act. If you have
> > received this communication in error, please destroy all electronic
> > and paper copies; do not disclose, use or act upon the information;
> > and notify the sender immediately. Mistransmission is not intended to
> > waive confidentiality or privilege. Morgan Stanley reserves the
> > right, to the extent permitted under applicable law, to monitor
> > electronic communications. This message is subject to terms available
> > at the following link: http://www.morganstanley.com/disclaimers. If
> > you cannot access these links, please notify us by reply message and
> > we will send the contents to you. By messaging with Morgan Stanley
> > you consent to the foregoing.
> > _______________________________________________
> > Ldapext mailing list
> > Ldapext@ietf.org
> > https://www.ietf.org/mailman/listinfo/ldapext
>
> _______________________________________________
> Ldapext mailing list
> Ldapext@ietf.org
> https://www.ietf.org/mailman/listinfo/ldapext
>

--001a113fb648b24d220525892281
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">Uids have not been numeric since RSTS/E and RSX.=C2=A0 The n=
ame is a contraction of &quot;user identifier&quot; and in Unix they are th=
e first field of the passwd data object and are intended to be unique keys.=
=C2=A0 The numeric key associated with a uid is the uidno or &quot;user ide=
ntifier NUMBER&quot;.</p>
<p dir=3D"ltr">In modern deployments the taxon &quot;login name&quot; is im=
precise and not unique; I can and do &quot;log in&quot; using several diffe=
rent naming conventions (SAMname, Kerberos principal, or LDAP distinguished=
 name, which are all different) and all of those identify me to the system =
as the unique user id keyed by &quot;uid&quot;.=C2=A0 POSIX file systems ta=
g files with uidnos, and these are just-in-time looked up to determine the =
user id currently associated with the uidno.=C2=A0 That abstraction layer l=
ets the names of groups and users be changed without massive wholesale revi=
sion of filesystem metadata, providing administrative scalability. </p>
<p dir=3D"ltr">Thus, a uid is neither a login name nor a number; when clean=
ly implemented, it is a unique alphanumeric key.=C2=A0 This is quite differ=
ent from the Microsoft SID-based system, but can be made compatible for mos=
t purposes by making uids and SAMnames identical.</p>
<p dir=3D"ltr">Netgroups are indeed an abomination and I=C2=A0 should rejoi=
ce if they were to disappear.=C2=A0 Beers would be consumed.</p>
<p dir=3D"ltr">Unix was intended by Ritchie et al to be case-sensitive, and=
 significant implementations exist that assume this.=C2=A0 However, I have =
converted a medium sized enterprise (less than 200 named groups) to case in=
sensitivity, by renaming groups while retaining gidnos, during an LDAP conv=
ersion.=C2=A0 It&#39;s a significant effort but nowhere near the complexity=
 of converting to a shared group and user namespace such as Microsoft AD im=
plements; duplication of names in the group and user namespaces is commonpl=
ace in linux deployments.</p>
<p dir=3D"ltr">Hoping that this was helpful and I&#39;m not flogging any de=
ceased equines,<br>
--Charlie Brooks</p>
<div class=3D"gmail_quote">On Nov 27, 2015 10:06 AM, &quot;Simo Sorce&quot;=
 &lt;<a href=3D"mailto:idra@samba.org">idra@samba.org</a>&gt; wrote:<br typ=
e=3D"attribution"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .=
8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, 2015-11-26 at 11:0=
1 +0000, Bannister, Mark wrote:<br>
&gt; =EF=BB=BFHi Jordan,<br>
&gt;<br>
&gt; This is all excellent feedback, thanks, I really appreciate the time<b=
r>
&gt; you have taken to provide your<br>
&gt; comments.=C2=A0 Many of the points you raise I did spend a long time<b=
r>
&gt; considering myself when I was<br>
&gt; writing the internet drafts, so I hope to provide you with more<br>
&gt; insight into my rationale and why<br>
&gt; I decided to do things the way I did.<br>
&gt;<br>
&gt; I hope you don&#39;t mind but I&#39;m copying it to the ldapext mailin=
g list,<br>
&gt; so that others can also<br>
&gt; comment if they wish.=C2=A0 For others, Jordan is commenting from the<=
br>
&gt; DBIS/RFC2307<br>
&gt; schema comparison and not directly from the internet drafts:<br>
&gt;<br>
&gt; <a href=3D"http://sourceforge.net/p/dbis/wiki/DBIS%20and%20RFC2307%20s=
chemas/">http://sourceforge.net/p/dbis/wiki/DBIS%20and%20RFC2307%20schemas/=
</a><br>
&gt;<br>
&gt; Jordan Brown wrote:<br>
&gt; &gt; High-level comments:<br>
&gt; &gt; - In general, our direction is towards X.500 compatibility and<br=
>
&gt; &gt; Active Directory compatibility.=C2=A0 I would<br>
&gt; &gt;=C2=A0 =C2=A0resist new mechanisms that duplicate those.<br>
&gt; &gt; - As noted in more detail below, I consider case-insensitive<br>
&gt; &gt; processing to be the correct direction and<br>
&gt; &gt;=C2=A0 =C2=A0would resist moves towards case sensitivity.<br>
&gt; &gt; - Some of the mechanisms here (e.g. gecos mapping) seem to<br>
&gt; &gt; duplicate RFC 4876 profiles.<br>
&gt;<br>
&gt; Thanks for the summary, I&#39;ll answer these points individually as I=
<br>
&gt; get to them below.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; Footnote 1 says that published classes may not be redefined.<br>
&gt; &gt; Although not all changes seem permissible,<br>
&gt; &gt; some changes (e.g. addition of MAY elements) seem like they could=
<br>
&gt; &gt; be allowed.=C2=A0 Is there a reference for<br>
&gt; &gt; this restriction?=C2=A0 Note that between X.521-1993 and X.521-20=
12 the<br>
&gt; &gt; TelecommunicationAttributeSet had<br>
&gt; &gt; an attribute deleted.<br>
&gt;<br>
&gt; I haven&#39;t looked for a reference to this restriction, I had learne=
d<br>
&gt; it from seeing previous exchanges<br>
&gt; on the ldapext mailing list with Kurt Zeilenga.=C2=A0 Here is one such=
<br>
&gt; exchange, regarding changing the<br>
&gt; schema declaration of &#39;posixGroup&#39; in RFC2307bis:<br>
&gt;<br>
&gt; <a href=3D"https://www.ietf.org/mail-archive/web/ldapext/current/msg02=
072.html">https://www.ietf.org/mail-archive/web/ldapext/current/msg02072.ht=
ml</a><br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; posixAccount / posixUserAccount<br>
&gt; &gt;<br>
&gt; &gt; en:=C2=A0 I consider the change from a case-sensitive name in NIS=
 to a<br>
&gt; &gt; case-insensitive name in LDAP to be an<br>
&gt; &gt; improvement that should not be reversed.=C2=A0 It is telling that=
 (a)<br>
&gt; &gt; there are no cases in the industry other<br>
&gt; &gt; than UNIX user names where user names are case sensitive, (b) tha=
t<br>
&gt; &gt; there are numerous examples in<br>
&gt; &gt; the industry of treating the left side of an e-mail address as ca=
se<br>
&gt; &gt; -insensitive, and (c) the X.520 &quot;name&quot;<br>
&gt; &gt; attribute, the base attribute for all naming, is case-insensitive=
.<br>
&gt;<br>
&gt; NIS was case sensitive.=C2=A0 That led some firms to put entries in<br=
>
&gt; various maps that were the same except<br>
&gt; for case.=C2=A0 I have examples here where this occurs in the passwd,<=
br>
&gt; group, netgroup and services maps.<br>
&gt; Changing these entries would be a) very difficult indeed to the point<=
br>
&gt; of insurmountable as they&#39;ve<br>
&gt; been ingrained in many systems in a very large enterprise for over a<b=
r>
&gt; decade and b) unnecessary had<br>
&gt; the RFC2307 schema been 100% backwards compatible with NIS.<br>
<br>
NIS was just a poor job of taking the passwd and group files and<br>
reproducing them verbatim in a networked environment, and it badly at<br>
it.<br>
Case sensitive names is something that may be wanted by some legacy<br>
environments, but it is really a bad idea in modern environments and<br>
should be discouraged.<br>
I firmly believe you could have a way to allow case-sensitive names,<br>
but insensitive names should be the default and recommended way, I<br>
fully agree with Jordan on this.<br>
<br>
Usernames are used by *users*, not just by machines, and most users<br>
(and admins) will consider the Mark and mark to be the same thing, and<br>
rightly so, it is. Any system that allows you to have two users with<br>
substantially the same name is a failure and a security issue waiting<br>
to happen, so that should not be encouraged.<br>
<br>
<br>
&gt;=C2=A0 =C2=A0I explain this rationale further in my<br>
&gt; DBIS paper:<br>
&gt;<br>
&gt; <a href=3D"http://ldapcon.org/2015/wp-content/uploads/2015/09/DBIS-Pap=
er-2015.pd">http://ldapcon.org/2015/wp-content/uploads/2015/09/DBIS-Paper-2=
015.pd</a><br>
&gt; f<br>
&gt;<br>
&gt; We had a few choices.=C2=A0 The one which we used for the past few yea=
rs<br>
&gt; was to define our own custom<br>
&gt; schema.=C2=A0 We had to invent three new custom attributes and seven n=
ew<br>
&gt; custom object classes to<br>
&gt; get around this limitation.=C2=A0 It infuriated me that we couldn&#39;=
t use<br>
&gt; RFC2307 out-of-the-box because it<br>
&gt; was not 100% compatible with the NIS schema, and this was one of the<b=
r>
&gt; primary driving forces<br>
&gt; behind me starting DBIS.<br>
&gt;<br>
&gt; DBIS is my stake in the ground to say we MUST solve this problem.=C2=
=A0 I<br>
&gt; hear what you&#39;re saying,<br>
&gt; but your arguments for case insensitivity disregard that UNIX is<br>
&gt; primarily a case-sensitive<br>
&gt; operating system and that NIS was also case-sensitive.=C2=A0 Frankly, =
as<br>
&gt; RFC2307 was supposed to<br>
&gt; be primarily getting NIS data into LDAP, it failed tremendously by<br>
&gt; bending to the Windows/AD<br>
&gt; case insensitivity preferences.=C2=A0 UNIX will not change.=C2=A0 It w=
ill<br>
&gt; always be case sensitive.=C2=A0 Therefore<br>
&gt; we need an LDAP schema that will respect that.<br>
<br>
Unix passwd files are case sensitive, that doesn&#39;t mean LDAP has to be<=
br>
at all. If you have the right pam/nss modules you can definitely behave<br>
in both case preserving or case insensitive ways easily, and the Unix<br>
system will not care. The kernel cares only about uidNumber/gidNumber<br>
and names are just a representation.<br>
There are unfortunately people that code their applications in a way<br>
that user user/group names fro access control without first resolving<br>
them to their numeric identifier, those are already broken wrt renames,<br>
and may be broken if you return a random case from nsswitch plugins,<br>
but you do not have to return a random case from a nsswitch plugin you<br>
can simply always return all lowercase and your system is perfectly<br>
consistent then.<br>
<br>
Proof is that we&#39;ve been using case-insensitive setups for more than a<=
br>
decade (both LDAP, and Samba/Windows based source of user information)<br>
and it works in 99.9% of setups.<br>
<br>
&gt; I hope this doesn&#39;t mean we end up with one schema for UNIX and on=
e<br>
&gt; for Windows, perhaps<br>
&gt; we can be creative, for example, encouraging Windows software to<br>
&gt; force all characters to<br>
&gt; lowercase before adding entries to LDAP and constructing search<br>
&gt; filters, although this will<br>
&gt; probably be prone to breakage.<br>
<br>
Any new schema for LDAP that insist on being only case sensitive is<br>
simply broken and cannot be a standard IMHO.<br>
<br>
&gt;=C2=A0 =C2=A0Or perhaps we can define some special attributes where cas=
e<br>
&gt; is handled differently depending on the capability of the client.<br>
<br>
A schema that allows to define sensitivity *may* work, depending on the<br>
details.<br>
<br>
&gt;=C2=A0 =C2=A0If the client claims it is<br>
&gt; case sensitive, these special attributes are handled case<br>
&gt; sensitively, and vice versa if the client<br>
&gt; claims it is case insensitive.=C2=A0 I see case sensitivity as an issu=
e<br>
&gt; that will prevail forever, in the<br>
&gt; same way that endianness will differ between architectures; they will<=
br>
&gt; never converge and<br>
&gt; so we should not be accepting standards that do not provide a<br>
&gt; solution for both types.<br>
<br>
Not sure about that, we have experience that unix/linux system can work<br>
just fine with case insensitive user names, only some broken/legacy<br>
setup cannot cope because of existing broken data, but that is not a<br>
Unix issue, it is a specific deployment issue. It is ok to let those<br>
deployments have an option perhaps (I think they are just broken on<br>
security grounds, but that&#39;s just my opinion) but I think your<br>
characterization that Unix/Liunux clients can only cope with case<br>
sensitive names is misleading, given we have experience that they can<br>
cope just fine assuming the nsswitch and pam module used are properly<br>
built to deal with that.<br>
<br>
&gt; &gt;<br>
&gt; &gt; authPassword:=C2=A0 Imported from RFC2307bis-02 and thence from R=
FC<br>
&gt; &gt; 3112.=C2=A0 Partially, but only partially,<br>
&gt; &gt; duplicates userPassword (from X.509 via RFC2307).=C2=A0 Appears t=
o<br>
&gt; &gt; completely duplicate userPwd (also<br>
&gt; &gt; from X.509).=C2=A0 May also duplicate encryptedUserPassword, ment=
ioned<br>
&gt; &gt; in X.520 but not defined<br>
&gt; &gt; anywhere that I can find.<br>
&gt;<br>
&gt; I added authPassword simply because I wanted those using RFC2307bis<br=
>
&gt; to be able to migrate<br>
&gt; seamlessly to DBIS.=C2=A0 I made it clear in the drafts that there are=
<br>
&gt; better and more secure ways to store<br>
&gt; passwords and these should be used in preference - authPassword was<br=
>
&gt; provided for backwards<br>
&gt; compatibility only.<br>
&gt;<br>
&gt; If you have an issue with authPassword being in RFC2307bis, now is<br>
&gt; the time to raise it, as it<br>
&gt; is on the new LDAPEXT charter and the WG are planning to finalise<br>
&gt; RFC2307bis in the<br>
&gt; next 12 months and give it its own RFC number.<br>
<br>
I have the issue that in 2015 we cannot propose standards that assume<br>
password hashes are distributed outside of the directory, and that<br>
password storage should definitely be an implementation detail (it can<br>
be standardized, but not necessarily with an identity information<br>
standard). Clients should just use ldap binds and let the LDAP server<br>
handle internally how authentication is handled (may not be a password<br>
at all).<br>
<br>
&gt; &gt; gecos:=C2=A0 Removed in DBIS with no explicit replacement.=C2=A0 =
DBIS<br>
&gt; &gt; recommends using its mapping capabilities<br>
&gt; &gt; to map gecos onto some other attribute, e.g. displayName.=C2=A0 W=
hile<br>
&gt; &gt; eliminating gecos seems desirable<br>
&gt; &gt; (as an unnecessarily UNIX-specific attribute), it seems desirable=
<br>
&gt; &gt; to explicitly specify a replacement<br>
&gt; &gt; rather than to rely on custom mapping.=C2=A0 (Note also that some=
<br>
&gt; &gt; implementations have encoded<br>
&gt; &gt; additional information, e.g. telephone number, into the gecos<br>
&gt; &gt; field.=C2=A0 This seems like an undesirable<br>
&gt; &gt; overloading of the schema.)<br>
&gt;<br>
&gt; LDAP is so much better at representing all kinds of random<br>
&gt; information than NIS was, and the passwd<br>
&gt; flat-text file.=C2=A0 Just because there was a random &quot;throw in a=
ny<br>
&gt; information you like&quot; including an<br>
&gt; implied encouragement in Sun Microsystems&#39; training courses to<br>
&gt; include telephone information<br>
&gt; in the gecos field, does not mean that when you move to a much more<br=
>
&gt; structured system such<br>
&gt; as LDAP you have to keep the general purpose nonsense.=C2=A0 If you wa=
nt<br>
&gt; to encode a telephone number,<br>
&gt; there is an attribute for that.=C2=A0 If you want a surname, or a firs=
t<br>
&gt; name, there are attributes for that<br>
&gt; too.=C2=A0 &quot;Gecos&quot; is not a unique piece of information, it =
is a container<br>
&gt; for an assortment of data, which<br>
&gt; will differ from one firm to the next.=C2=A0 The equivalent to &quot;g=
ecos&quot; is<br>
&gt; an LDAP object.<br>
<br>
I tend to agree with this sentiment.<br>
<br>
&gt; &gt;<br>
&gt; &gt; description:=C2=A0 Removed from explicit mention in DBIS, but inh=
erited<br>
&gt; &gt; from Person if inetOrgPerson is<br>
&gt; &gt; used as the base class.=C2=A0 Not clear how it fits into the UNIX=
/NIS<br>
&gt; &gt; schema.<br>
&gt;<br>
&gt; I removed it because I saw no purpose for it on a passwd entry, and<br=
>
&gt; as you say you can get it<br>
&gt; back again if you include another auxiliary class which you probably<b=
r>
&gt; want to do<br>
&gt; anyway to have something to map gecos to.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; Structural User Account:=C2=A0 changes from &quot;account&quot; (=
RFC 4524) to<br>
&gt; &gt; &quot;inetOrgPerson&quot;<br>
&gt; &gt; (RFC 2798).=C2=A0 While this is an obvious simplification, it doe=
s not<br>
&gt; &gt; seem correct.<br>
&gt; &gt; An account may be associated with more than one person, and one<b=
r>
&gt; &gt; person may be associated with<br>
&gt; &gt; more than one account.=C2=A0 (However, associating it with &quot;=
account&quot;<br>
&gt; &gt; leaves it unclear where to collect a gecos/display name, except<b=
r>
&gt; &gt; perhaps<br>
&gt; &gt; &quot;description&quot;.)<br>
&gt;<br>
&gt; Quite, &quot;account&quot; doesn&#39;t have a field where you can sens=
ibly put the<br>
&gt; descriptive<br>
&gt; name of the user, whereas inetOrgPerson does.=C2=A0 In a previous proj=
ect<br>
&gt; where we<br>
&gt; were migrating NIS to AD, we used displayName to hold the contents of<=
br>
&gt; the<br>
&gt; gecos field, and that is what swayed my choice of inetOrgPerson here.<=
br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; posixGroup / posixGroupAccount<br>
&gt; &gt;<br>
&gt; &gt; X.521 groupOfNames seems like a more appropriate basis for the<br=
>
&gt; &gt; definition of a group.<br>
&gt;<br>
&gt; But that doesn&#39;t allow for GID number.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; en:=C2=A0 See above.<br>
&gt;<br>
&gt; Reply above.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; exactUser:=C2=A0 Ties into the case-sensitivity question.=C2=A0 I=
f case<br>
&gt; &gt; -insensitive, &quot;memberUid&quot; is reasonably<br>
&gt; &gt; appropriate, because in the LDAP world &quot;uid&quot; means &quo=
t;login name&quot;.<br>
&gt;<br>
&gt; &quot;uid&quot; meaning &quot;login name&quot; is a really bad choice.=
=C2=A0 I&#39;ve always<br>
&gt; thought that, and I&#39;ve pushed to get<br>
&gt; away from it in DBIS.=C2=A0 UID is a number, it should always be a num=
ber,<br>
&gt; why anyone thought it would<br>
&gt; be a good idea for that to actually be a name escapes me.=C2=A0 I&#39;=
ve<br>
&gt; discussed the case sensitivity<br>
&gt; issue already, and I called this &quot;exactUser&quot; to follow-on fr=
om the<br>
&gt; idea of exact case, and to<br>
&gt; follow a similar line as &quot;exactName&quot; (en).<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; manager:=C2=A0 although not inappropriate, X.520 &quot;owner&quot=
; seems more<br>
&gt; &gt; appropriate.=C2=A0 (And note that<br>
&gt; &gt; groupOfNames includes &quot;owner&quot;.)<br>
&gt;<br>
&gt; As &quot;manager&quot; was already in RFC2307/2307bis for host and net=
work<br>
&gt; entries, I just expanded<br>
&gt; the support to many other entries, as it seemed a sensible thing to<br=
>
&gt; do.=C2=A0 Having some entries<br>
&gt; use &quot;owner&quot; and some use &quot;manager&quot; would be wrong,=
 removing &quot;manager&quot;<br>
&gt; from<br>
&gt; host and network entries would add an unnecessary step when migrating<=
br>
&gt; from an RFC2307<br>
&gt; to a DBIS schema, and allowing both &quot;owner&quot; and &quot;manage=
r&quot; seems<br>
&gt; excessive.<br>
<br>
Actually owner and manager are quite different concepts, and allowing<br>
both would not be bad idea.<br>
<br>
&gt; &gt;<br>
&gt; &gt; nisNetgroup / netgroupObject<br>
&gt; &gt;<br>
&gt; &gt; Although not a perfect match, groupOfNames seems like it might be=
 a<br>
&gt; &gt; better basis for<br>
&gt; &gt; grouping computers.<br>
&gt;<br>
&gt; netgroups are a specific construct, trying to squeeze them into<br>
&gt; something else that is<br>
&gt; not a perfect match would be a suboptimal decision.=C2=A0 LDAP can<br>
&gt; represent netgroup<br>
&gt; data better, so let&#39;s represent it better.<br>
<br>
Netgroups are an abomination that should die. People should migrate off<br>
of them, and we should not encode that abomination into a new standard<br>
in 2015. This is one of the things that have me opposed to DBIS as a<br>
standard, leave netgroups to RFC2307 and let them die there.<br>
<br>
&gt; &gt;<br>
&gt; &gt; All of the changes here seem to relate to issues described above.=
<br>
&gt; &gt;<br>
&gt; &gt; ipService / ipServiceObject<br>
&gt; &gt; ipProtocol / ipProtocolObject<br>
&gt; &gt;<br>
&gt; &gt; The changes here all appear to be similar to those described abov=
e,<br>
&gt; &gt; with the note that case<br>
&gt; &gt; sensitivity here seems especially pointless.<br>
&gt;<br>
&gt; Not at all pointless given that we have real world examples of<br>
&gt; service names,<br>
&gt; one in uppercase, one in lowercase, which have two different port<br>
&gt; numbers assigned.<br>
&gt; If DBIS did not have an answer to that, we&#39;d be back to using a<br=
>
&gt; custom schema,<br>
&gt; which defeats the object of the exercise.=C2=A0 NIS was case sensitive=
,<br>
&gt; DBIS aims to be<br>
&gt; 100% compatible with the NIS schema, as previously discussed.<br>
<br>
NIS is dead Jim, dead! :-)<br>
<br>
New standards should define stuff useful for the future, not backward<br>
looking stuff that encodes and encroach mistakes done in the past.<br>
<br>
For people that needs backwards compat with NIS what you should do is<br>
simply define a generic NIS MAP object, and let individual sites store<br>
what they want on these &quot;maps&quot; including crusty old concepts that=
<br>
nobody should uses any more like the services and rpc maps.<br>
<br>
&gt; &gt; oncRpc / rpcObject<br>
&gt; &gt;<br>
&gt; &gt; ONC RPC is only one kind of RPC, so leaving &quot;ONC&quot; in it=
s name seems<br>
&gt; &gt; appropriate.<br>
&gt;<br>
&gt; RFC5531 is titled &quot;RPC&quot; not &quot;ONC RPC&quot;, and there i=
s no other type of<br>
&gt; RPC defined in an<br>
&gt; RFC as far as I am aware.=C2=A0 To me it was obvious what RPC referred=
 to.<br>
&gt;=C2=A0 =C2=A0I needed a new<br>
&gt; class anyway, and calling it oncRpcObject seemed unnecessary when<br>
&gt; rpcObject was<br>
&gt; clear enough.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; Again, the changes here all appear similar to those above.<br>
&gt; &gt;<br>
&gt; &gt; ipHost / ipHostObject<br>
&gt; &gt;<br>
&gt; &gt; This schema doesn&#39;t seem to allow for a host that has both IP=
v4 and<br>
&gt; &gt; IPv6 addresses, nor for one<br>
&gt; &gt; that has no addresses.<br>
&gt;<br>
&gt; Mixing IPv4 and IPv6 should just be a case of assigning both the<br>
&gt; ipv4HostObject and ipv6HostObject<br>
&gt; classes to the same entry.=C2=A0 A host with no IP address, if we need=
 to<br>
&gt; support that, I suggest<br>
&gt; we change ipHostObject to be STRUCTURAL rather than ABSTRACT.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; While I could see using an LDAP directory as the back end for a D=
NS<br>
&gt; &gt; server, I could not see using<br>
&gt; &gt; it as the client&#39;s primary source for address&lt;-&gt;name ma=
pping.<br>
&gt; &gt; In fact, ripping that capability out of our LDAP support is on my=
<br>
&gt; &gt; list of things to do - it adds essentially<br>
&gt; &gt; zero value and occasionally causes problems.<br>
<br>
Amen<br>
<br>
&gt; I agree, but DBIS must be backwards compatible.<br>
<br>
For you it may be, but from a Standards body it is not necessarily the<br>
case, if your &quot;proposal&quot; is also &quot;unchangeable&quot; then th=
ere is no<br>
discussion to be had in this group, no discussion, means also no<br>
standard though (IMHO). As standards in IETF come from at least rough<br>
consensus and here I do not see much consensus nor a willingness to<br>
accept other points of view.<br>
<br>
<br>
Simo.<br>
<br>
<br>
&gt; &gt;<br>
&gt; &gt; ipNetwork/ipNetworkObject<br>
&gt; &gt;<br>
&gt; &gt; As above.<br>
&gt; &gt;<br>
&gt; &gt; automountMap / AutomountMapObject<br>
&gt; &gt;<br>
&gt; &gt; As above.<br>
&gt; &gt;<br>
&gt; &gt; automount / automountEntry<br>
&gt; &gt;<br>
&gt; &gt; If we&#39;re going to change definitions, we should ensure that t=
he new<br>
&gt; &gt; definition allows for SMB<br>
&gt; &gt; references in addition to NFS references. That suggests a URL for=
m.<br>
&gt;<br>
&gt; I actually added automountMapType to the draft but didn&#39;t update t=
he<br>
&gt; comparison table.<br>
&gt; This was so that we could also support amd-style entries.=C2=A0 I supp=
ose<br>
&gt; that is where we<br>
&gt; could also state that entries were smb-style entries too, and provide<=
br>
&gt; different<br>
&gt; attributes that are SMB-friendly.<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; Note that splitting automountInformation into automountLocation a=
nd<br>
&gt; &gt; automountOption means<br>
&gt; &gt; that you can&#39;t have multiple locations with different options=
.<br>
&gt;<br>
&gt; You&#39;re right, but why would you do that?<br>
&gt;<br>
&gt; &gt;<br>
&gt; &gt; automountMulti<br>
&gt; &gt;<br>
&gt; &gt; I don&#39;t yet understand what this class is for.<br>
&gt;<br>
&gt; I&#39;ve renamed this to automountMultiMount in the draft and didn&#39=
;t<br>
&gt; update the table.<br>
&gt; This is for Solaris-style multi-mount entries.=C2=A0 I think they&#39;=
re being<br>
&gt; referred to as<br>
&gt; hierarchical mounts now, but see some example entries here:<br>
&gt;<br>
&gt; <a href=3D"http://sourceforge.net/p/dbis/wiki/Map%20Entries/">http://s=
ourceforge.net/p/dbis/wiki/Map%20Entries/</a><br>
&gt;<br>
&gt; Best regards,<br>
&gt; Mark.<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt;<br>
&gt; ---------------------------------------------------------------------<=
br>
&gt; -----------<br>
&gt;<br>
&gt; NOTICE: Morgan Stanley is not acting as a municipal advisor and the<br=
>
&gt; opinions or views contained herein are not intended to be, and do not<=
br>
&gt; constitute, advice within the meaning of Section 975 of the Dodd<br>
&gt; -Frank Wall Street Reform and Consumer Protection Act. If you have<br>
&gt; received this communication in error, please destroy all electronic<br=
>
&gt; and paper copies; do not disclose, use or act upon the information;<br=
>
&gt; and notify the sender immediately. Mistransmission is not intended to<=
br>
&gt; waive confidentiality or privilege. Morgan Stanley reserves the<br>
&gt; right, to the extent permitted under applicable law, to monitor<br>
&gt; electronic communications. This message is subject to terms available<=
br>
&gt; at the following link: <a href=3D"http://www.morganstanley.com/disclai=
mers">http://www.morganstanley.com/disclaimers</a>. If<br>
&gt; you cannot access these links, please notify us by reply message and<b=
r>
&gt; we will send the contents to you. By messaging with Morgan Stanley<br>
&gt; you consent to the foregoing.<br>
&gt; _______________________________________________<br>
&gt; Ldapext mailing list<br>
&gt; <a href=3D"mailto:Ldapext@ietf.org">Ldapext@ietf.org</a><br>
&gt; <a href=3D"https://www.ietf.org/mailman/listinfo/ldapext">https://www.=
ietf.org/mailman/listinfo/ldapext</a><br>
<br>
_______________________________________________<br>
Ldapext mailing list<br>
<a href=3D"mailto:Ldapext@ietf.org">Ldapext@ietf.org</a><br>
<a href=3D"https://www.ietf.org/mailman/listinfo/ldapext">https://www.ietf.=
org/mailman/listinfo/ldapext</a><br>
</blockquote></div>

--001a113fb648b24d220525892281--


From nobody Mon Nov 30 12:06:22 2015
Return-Path: <Jordan.Brown@oracle.com>
X-Original-To: ldapext@ietfa.amsl.com
Delivered-To: ldapext@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 855AB1B303E for <ldapext@ietfa.amsl.com>; Mon, 30 Nov 2015 12:06:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level: 
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AtFuDb23mwa6 for <ldapext@ietfa.amsl.com>; Mon, 30 Nov 2015 12:06:17 -0800 (PST)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AE311B3042 for <ldapext@ietf.org>; Mon, 30 Nov 2015 12:06:17 -0800 (PST)
Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id tAUK6G26023243 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 30 Nov 2015 20:06:16 GMT
Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserv0021.oracle.com (8.13.8/8.13.8) with ESMTP id tAUK6FIv030893 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Mon, 30 Nov 2015 20:06:16 GMT
Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by userv0121.oracle.com (8.13.8/8.13.8) with ESMTP id tAUK6FVb024852; Mon, 30 Nov 2015 20:06:15 GMT
Received: from [10.159.252.119] (/10.159.252.119) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 30 Nov 2015 12:06:15 -0800
To: "Bannister, Mark" <Mark.Bannister@morganstanley.com>
References: <5655E4F0.7030809@oracle.com> <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
From: Jordan Brown <Jordan.Brown@oracle.com>
Message-ID: <565CAC30.6010701@oracle.com>
Date: Mon, 30 Nov 2015 12:06:08 -0800
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0 SeaMonkey/2.39
MIME-Version: 1.0
In-Reply-To: <814F4E458AA9FF4E89CF1A9EDA0DE2A932F618A3@OZWEX0209N1.msad.ms.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Source-IP: aserv0021.oracle.com [141.146.126.233]
Archived-At: <http://mailarchive.ietf.org/arch/msg/ldapext/CrfE6iZi9FPXydSn8fbIsfJWCxc>
Cc: "'ldapext@ietf.org'" <ldapext@ietf.org>
Subject: Re: [ldapext] DBIS commentary
X-BeenThere: ldapext@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: LDAP Extension Working Group <ldapext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ldapext>, <mailto:ldapext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ldapext/>
List-Post: <mailto:ldapext@ietf.org>
List-Help: <mailto:ldapext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ldapext>, <mailto:ldapext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 30 Nov 2015 20:06:20 -0000

On 11/26/2015 3:01 AM, Bannister, Mark wrote:
>> Footnote 1 says that published classes may not be redefined. Although not all changes seem permissible,
>> some changes (e.g. addition of MAY elements) seem like they could be allowed.  Is there a reference for
>> this restriction?  Note that between X.521-1993 and X.521-2012 the TelecommunicationAttributeSet had
>> an attribute deleted.
> I haven't looked for a reference to this restriction, I had learned it from seeing previous exchanges
> on the ldapext mailing list with Kurt Zeilenga.  Here is one such exchange, regarding changing the
> schema declaration of 'posixGroup' in RFC2307bis:
>
> https://www.ietf.org/mail-archive/web/ldapext/current/msg02072.html

He does seem to have a pretty strict stance on the matter.  Still, the X.519 
reference that Steven supplied suggests that there may be wiggle room there.  I 
don't know whether it's enough wiggle room to be helpful here, but it seems worth 
keeping in mind.


On the case-sensitivity front:  we have a pretty fundamental disagreement.  I 
believe that UNIX names must eventually become case-insensitive, that it is only a 
matter of time until they do. UNIX is not the whole world, and the entire rest of 
the world is clear that MARK, Mark, and mark are the same person.  I've got to 
believe that even in the UNIX world those differ-only-in-case instances are 
steadily on the decline - anybody who is coexisting with Windows or has adopted 
RFC 2307 is using case-insensitive names and it seems unlikely that anybody would 
create new instances of problematic names.  Even a purely UNIX environment isn't 
purely case-insensitive - sendmail treats user names as case-insensitive for at 
least some purposes.

Transition is indeed painful.  RFC 4876 profiles and in particular the 
attributeMap mechanism can assist; you can use an attributeMap entry to direct the 
clients to use an alternative, case-sensitive, attribute for the user name if that 
is what you need.

>> authPassword:  Imported from RFC2307bis-02 and thence from RFC 3112.  Partially, but only partially,
>> duplicates userPassword (from X.509 via RFC2307).  Appears to completely duplicate userPwd (also
>> from X.509).  May also duplicate encryptedUserPassword, mentioned in X.520 but not defined
>> anywhere that I can find.
> I added authPassword simply because I wanted those using RFC2307bis to be able to migrate
> seamlessly to DBIS.  I made it clear in the drafts that there are better and more secure ways to store
> passwords and these should be used in preference - authPassword was provided for backwards
> compatibility only.
>
> If you have an issue with authPassword being in RFC2307bis, now is the time to raise it, as it
> is on the new LDAPEXT charter and the WG are planning to finalise RFC2307bis in the
> next 12 months and give it its own RFC number.

I recommend looking pretty hard at whether a new attribute is needed, given that 
there seem to be three other existing attributes.

In general, it seems best to discourage making password hashes visible - perhaps 
even to the point of not standardizing them.

>> gecos:  Removed in DBIS with no explicit replacement.  DBIS recommends using its mapping capabilities
>> to map gecos onto some other attribute, e.g. displayName.  While eliminating gecos seems desirable
>> (as an unnecessarily UNIX-specific attribute), it seems desirable to explicitly specify a replacement
>> rather than to rely on custom mapping.  (Note also that some implementations have encoded
>> additional information, e.g. telephone number, into the gecos field.  This seems like an undesirable
>> overloading of the schema.)
> LDAP is so much better at representing all kinds of random information than NIS was, and the passwd
> flat-text file.  Just because there was a random "throw in any information you like" including an
> implied encouragement in Sun Microsystems' training courses to include telephone information
> in the gecos field, does not mean that when you move to a much more structured system such
> as LDAP you have to keep the general purpose nonsense.  If you want to encode a telephone number,
> there is an attribute for that.  If you want a surname, or a first name, there are attributes for that
> too.  "Gecos" is not a unique piece of information, it is a container for an assortment of data, which
> will differ from one firm to the next.  The equivalent to "gecos" is an LDAP object.

Sorry, my side note ended up dominating the conversation.  I agree that 
overloading information into the gecos field is undesirable and that LDAP 
attributes should be used.

My key point here is that DBIS should specify what attribute should replace it, 
what attribute clients are expected to use to populate the pw_gecos field in 
struct passwd.

>> Structural User Account:  changes from "account" (RFC 4524) to "inetOrgPerson"
>> (RFC 2798).  While this is an obvious simplification, it does not seem correct.
>> An account may be associated with more than one person, and one person may be associated with
>> more than one account.  (However, associating it with "account"
>> leaves it unclear where to collect a gecos/display name, except perhaps
>> "description".)
> Quite, "account" doesn't have a field where you can sensibly put the descriptive
> name of the user, whereas inetOrgPerson does.  In a previous project where we
> were migrating NIS to AD, we used displayName to hold the contents of the
> gecos field, and that is what swayed my choice of inetOrgPerson here.

It seems like the right answer there would be a subclass of "account" with a "MAY 
displayName", to preserve the database normalization that lets you have accounts 
that are associated with more than one person (or with no person at all) and 
people who are associated with more than one account.

(But I see that inetOrgPerson includes "uid", suggesting that it was also intended 
to represent a computer account.)

>> posixGroup / posixGroupAccount
>>
>> X.521 groupOfNames seems like a more appropriate basis for the definition of a group.
> But that doesn't allow for GID number.

A subclass does.

>> exactUser:  Ties into the case-sensitivity question.  If case-insensitive, "memberUid" is reasonably
>> appropriate, because in the LDAP world "uid" means "login name".
> "uid" meaning "login name" is a really bad choice. I've always thought that, and I've pushed to get
> away from it in DBIS.  UID is a number, it should always be a number, why anyone thought it would
> be a good idea for that to actually be a name escapes me.  I've discussed the case sensitivity
> issue already, and I called this "exactUser" to follow-on from the idea of exact case, and to
> follow a similar line as "exactName" (en).

Again, UNIX is not the entire world.  RFC 2307 is not the primary reference for 
"uid" - RFC 2798 (inetOrgPerson) is, adopted and renamed from RFC 1274 "userid".  
(I presume that the earlier publication in RFC 2307 is an accident of the 
development timelines of the two documents.)

Yes, it's confusing for UNIX people, but it's the standard.


>> manager:  although not inappropriate, X.520 "owner" seems more appropriate.  (And note that
>> groupOfNames includes "owner".)
> As "manager" was already in RFC2307/2307bis for host and network entries, I just expanded
> the support to many other entries, as it seemed a sensible thing to do.  Having some entries
> use "owner" and some use "manager" would be wrong, removing "manager" from
> host and network entries would add an unnecessary step when migrating from an RFC2307
> to a DBIS schema, and allowing both "owner" and "manager" seems excessive.

No strong opinion.


>> nisNetgroup / netgroupObject
>>
>> Although not a perfect match, groupOfNames seems like it might be a better basis for
>> grouping computers.
> netgroups are a specific construct, trying to squeeze them into something else that is
> not a perfect match would be a suboptimal decision.  LDAP can represent netgroup
> data better, so let's represent it better.

Yes, it can... and for most purposes it has, in the form of groupOfNames.  If you 
have users represented in the directory, the natural way to group them is with 
groupOfNames.  If you have hosts represented in the directory, the natural way to 
group them is with groupOfNames.  The only thing that there isn't an obvious way 
to group is "user X on host Y".  Not that I've seen a lot of concrete instances of 
netgroups, but I don't think I've seen one of those yet.

I believe Active Directory makes extensive use of groups of computers; 
interoperating seems desirable.

>> All of the changes here seem to relate to issues described above.
>>
>> ipService / ipServiceObject
>> ipProtocol / ipProtocolObject
>>
>> The changes here all appear to be similar to those described above, with the note that case
>> sensitivity here seems especially pointless.
> Not at all pointless given that we have real world examples of service names,
> one in uppercase, one in lowercase, which have two different port numbers assigned.
> If DBIS did not have an answer to that, we'd be back to using a custom schema,
> which defeats the object of the exercise.  NIS was case sensitive, DBIS aims to be
> 100% compatible with the NIS schema, as previously discussed.

Having two names that differ only in case lead to different port numbers seems 
like a spectacularly bad idea.  If there's an organization that has somehow found 
themselves in such a mess then I'm very sorry for them, but the real answer is 
that they need to extricate themselves from the mess rather than spreading it.

IANA is the reference for service names, and RFC 6335 says that they are 
case-insensitive.


>> oncRpc / rpcObject
>>
>> ONC RPC is only one kind of RPC, so leaving "ONC" in its name seems appropriate.
> RFC5531 is titled "RPC" not "ONC RPC", and there is no other type of RPC defined in an
> RFC as far as I am aware.  To me it was obvious what RPC referred to.  I needed a new
> class anyway, and calling it oncRpcObject seemed unnecessary when rpcObject was
> clear enough.

Although the title of RFC 5531 is "RPC: ...", the opening sentence says "This 
document specifies version 2 of the message protocol used in ONC Remote Procedure 
Call (RPC).".

XML-RPC seems to have somehow dodged getting an RFC, but is referenced by RFC 3529.
JSON-RPC seems to have at least something of a footprint, but no RFC.


>
>> ipHost / ipHostObject
>>
>> This schema doesn't seem to allow for a host that has both IPv4 and IPv6 addresses, nor for one
>> that has no addresses.
> Mixing IPv4 and IPv6 should just be a case of assigning both the ipv4HostObject and ipv6HostObject
> classes to the same entry.

You have ipv4HostObject and ipv6HostObject defined as structural classes, and a 
given object can have only one structural class.

> A host with no IP address, if we need to support that, I suggest
> we change ipHostObject to be STRUCTURAL rather than ABSTRACT.

Yes.

We should also look at prior art.  Active Directory defines schemas for 
representing computers; it would seem remiss to not attempt to interoperate.

Again, that's if we need to include a "hosts" replacement at all.

(One reason to include one:  groups of hosts.)

>> While I could see using an LDAP directory as the back end for a DNS server, I could not see using
>> it as the client's primary source for address<->name mapping.
>> In fact, ripping that capability out of our LDAP support is on my list of things to do - it adds essentially
>> zero value and occasionally causes problems.
> I agree, but DBIS must be backwards compatible.

When we're creating entirely new schema, backwards compatibility is not an 
absolute constraint.  Discarding evolutionary dead ends has substantial value.

>> Note that splitting automountInformation into automountLocation and automountOption means
>> that you can't have multiple locations with different options.
> You're right, but why would you do that?

I blindly assumed that the existing schema made sense :-)

Indeed, the underlying file-based automount schema doesn't seem to allow different 
locations to have different options.

