Re: [ldapext] DBIS - new IETF drafts

[Michael Ströder <[e-mail]>]

Mark R Bannister wrote:
> On 09/01/2014 14:50, Michael Ströder wrote:
>> Mark R Bannister wrote:
>>> I don't personally like the idea
>>> of having per-user shadow attributes, however some might see it as a feature
>>> and there may be some edge cases where this is exactly what is required.
>> AFAICS today nobody is seriously using LDAP with shadow attributes anymore.
> 
> Please provide me some empirical evidence that this assertion is true.

Not numbers but my impression from lurking on various directory-related
mailing lists.

>>> draft-behera-ldap-password-policy-10 is already widely deployed, you say?
>>> Then it must go higher up in my reading list.
>> Yes, it's the only standard considered widely deployed. You have to know it.
> 
> Thanks.  Do we have any idea how widely adopted it is?

Currently everybody who wants to use LDAP password policy has to use it. It's
the only standard I know of for which is at least some client support implemented.

>>> Indeed, I agree, as stated earlier on I would whole-heartedly recommend
>>> against having user-specific policy settings.  However, providing the facility
>>> as an option for those who want to make minimal changes to their NIS
>>> environment is harmless.
>> If I replace NIS with LDAP I already have two options:
>> 1. Simply use RFC 2307(bis) for a naive transition
>> 2. Do a migration to really meaningful LDAP schema
>>
>> IMHO with 2. I can drop all NIS specific things anyway. You have to decide
>> whether DBIS is just an improvement for 1. or a real innvotation for 2.
> 
> It's 2.  Show me something I've done that's not "really meaningful" and we'll
> look at improving it.

Well, if you claim that you will implement a NIS/DBIS gateway you don't have
to define user-specific policy settings. You can map anything you want in your
gateway provided there's a reference from the user entry to the policy entry.
I'd go for a DN reference so you can make use of deref control.

Ciao, Michael.