Subject: interoperability limits: proposed addition to draft-ietf-ldup-replica-req-05.txt

From: "Mark Brown (REDMOND)" <[email-masked]>
Date: Wed, 20 Dec 2000 15:08:11 -0800

In San Diego there was some discussion of the limits of LDUP
interoperability.
John Strassner suggested that I draft some material for inclusion in the
requirements draft. Here it is.

The following material is meant to go right after the first paragraph of
Section 3
("The Models"), and just before the sentence "There are five data
consistency
models."

* * * * *

The objective is limited to replication between directory servers that
implement a passive store fully described by its LDAP schema. There are
two
ways in which directory servers commonly implement semantics that go
beyond
what the LDAP access protocol defines:

* Access control. LDAP does not currently define an access control
system.
  (The ldapext WG is working to extend LDAP with an access control
system.)
  Most directory servers implement an access control system.

  Replication between directory servers with different access control
systems
  will compromise directory security.

* Application triggers. Directory servers commonly integrate one or more
  specific applications. To achieve this integration the directory
server
  may intercept updates and run application-specific "trigger" code.
  Such triggers enforce directory invariants that cannot be expressed by
the
  LDAP schema.

  A simple trigger example is password policy enforcement. A directory
server might
  interpret a request to replace the current value of the userPassword
attribute
  with some new value as a request to first check that the new value
conforms
  to the server's password policy (e.g. the value is sufficiently long
and complex)
  before storing the new value. Using this trigger the directory server
avoids the
  security risk associated with passwords that are easy to attack.

  A more complex trigger example is password hashing. A directory server
might interpret
  a request to replace the current value of the userPassword attribute
with some
  new value as a request to compute one or more secure hashes of the new
value
  and store these hashes in one or more attributes, storing no value in
the
  userPassword attribute. Using this trigger the directory server avoids
the
  security exposure of storing the plaintext password.

  Replication between directory servers with different application
triggers
  will compromise directory integrity.

* * * * *

--mark

---

From: "John Strassner" <[email-masked]>
Date: Tue, 26 Dec 2000 15:42:57 -0800

Hi Mark,

thanks for your note. One small suggestion: in your second
point about

----- Original Message -----
From: "Mark Brown (REDMOND)"
<[email-masked]>
To: <[email-masked]>
Sent: Wednesday, December 20, 2000 3:08 PM
Subject: interoperability limits: proposed addition to
draft-ietf-ldup-replica-req-05.txt

---

From: "John Strassner" <[email-masked]>
Date: Tue, 26 Dec 2000 15:46:11 -0800

Hmm, looks like my message got truncated, let's try again.

Hi Mark,

thanks for your note. One small suggestion: in your second
point about application triggers, you say "Directory servers
commonly integrate one or more specific applications". I
think you meant that one or more applications may integrate
with a given directory server, right?

regards,
John