Re: Changes to {C}LDAP ASN.1

[Steve Kille <[e-mail]>]

Simon,

There have been a number of detailed comments on LDAP.   I don't want
to comment on these at this stage, as I think that its more important
to first address some broader architectural issues.

LDAP is a protocol specification without a service definition.   It is
able to achieve that by relying on X.500 as the service definition.
LDAP gives access to a strict subset of the X.500 Directory Abstract
Service.   Changes to LDAP which give access to more of the abstract
service are straightforward to handle.

A key advantage of LDAP is that is allows one to build simple
lightweight clients to access X.500.   All of the complex distributed
operation of multiple X.500 DSAs is hidden from the client.   I
believe that omission of DSA referrals is a key LDAP simplification.

LDAP could be used to access things other than X.500, or to access
things similar to, but different to X.500.   In this case, it might
make sense to extend LDAP in a way incompatible with X.500.   I think
that this is what you are trying to do.   If we are going to do this
(and I am not at all convinced that it is a good idea), there is a
need to define the service being accessed.   I'd suggest that before
undertaking any protocol specification, that there is a need to:

1) Define the overall information model.

2) Define the mechanism in which data is distributed amongst servers,
and the mechanisms for handling distributed operations.


Steve Kille