Re: CLDAP issues

[Alan Young <[e-mail]>]

> The reason for wanting to be able to authenticate individual messages is 
> that I'm working towards an architecture where there is no separate DSA;
> thus the binding is being made to the LDAP server not to the DSA. 

Is this another way of saying a DSA that supports (C)LDAP directly?

> As for the multiple search responses in one UDP datagram; this solution will
> work iff the protocol forbids search responses to be send in different 
> datagrams.

This looks like you want the CLDAP spec only to allow the grouped
response rather than it being a server implementation decision.  There
are two cases where this may be sub-optimal, both related to the size
limitation of UDP packets (but I guess that it would be less of an issue
over OSI CLTS): (a) when a Search returns multiple matches, the sum of
which would not fit in a single packet; (b) when a single Search match
only just fits in a single packet and where the added Search result
would blow the limit. 

You could also argue that the client needs added complexity to deal with
the reassembly. But it needs most of this complexity to deal with timeout
issues in any case. And the risk of loosing just a part of a complete
response still exists when IP is doing the reassembly, although I admit
that this risk is reduced.

For these reasons I prefer grouped responses to be a server
implementation (or runtime) decision. 

Alan.