Re: [ldapext] DBIS - new IETF drafts

[Howard Chu <[e-mail]>]

Mark R Bannister wrote:
> Do you have any more alarming problems that can be turned into simple
> requests?

Just read thru http://www.ietf.org/id/draft-bannister-dbis-policy-02.txt and 
again there's a lot of redundant work here, this time in regards to 
http://tools.ietf.org/html/draft-behera-ldap-password-policy-10

The obvious issue is collisions in some attribute descriptors with the ppolicy 
spec, which is already widely deployed.

More problematic is the data model itself, again. Storing the actual policy 
settings in the user entries will be unmanageable for any moderately large 
sized user population. This is one reason why draft-behera uses dedicated 
policy objects. It is the client side DUA's job to adapt the universal data 
store to the local host's security implementation. And we already have 
pam_ldap/nss_ldap/nss-pam-ldapd/nssov to perform these adaptations, so I don't 
see much value in defining yet another new broken data model that has no 
existing client support.

As much as you claim to have read and absorbed the prior work in this area, it 
really appears that you have ignored most of it.

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/