[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Issues with current authmeth draft.



Kurt D. Zeilenga wrote:

If the client knows instead a DN and password, then it should a mechanism intended for DN/password authentication (such as Simple bind over TLS).

From an interoperability perspective this has problems as a server is only required to implement DIGEST-MD5 and simple authentication, not TLS. This theoretical client would then only be able to interwork with servers which implement TLS or would be forced to use a less secure authentication mechanism (simple bind without TLS). This seems counter to the reasons in RFC2829 and [authmeth] for introducing SASL mechanisms, in particular, SASL DIGEST-MD5.


- Mark.