Re: Stringprep Considered Harmful

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

In revising the LDAP technical specification, the WG was
charged with resolving known interoperability problems,
including those in character string matching.  I believe
the WG understood (and understands) that fixing the general
character string matching problems requires invalidating
(or "breaking") some specific application uses of LDAP.  I
also believe the WG understands well the limitations of the
Stringprep solution and accepts those limitations as
reasonable given the situation.

Your comment "this may indicate the need for more MatchingRules
which correspond to those system's matching algorithms" is on
target.  Where the general-purpose matching rules (e.g.,
caseIgnoreMatch, caseExactMatch, etc.) are inappropriate in
some application-specific context, an application-specific
matching rule should be introduced OR the application should
specify that application-specific transformations (e.g., IDN
toASCII/toUnicode) be employed above the directory such that
matching with general purpose matching rules (e.g.,
octetStringMatch) in the directory behaves in a manner
appropriate for the application.

Kurt, as Editor.