Re: Authentication Methods for LDAP - last call

[Mark Wahl <M.Wahl@INNOSOFT.COM>]

> CRAM-MD5 requires a shared secret between client and server.

Most password based mechanisms do.  However the goal of this document is 
to avoid the use of the 'simple' password auth choice which send cleartext 
passwords on the network, not to say that the only way to authenticate to
a directory is with a password.  That is why section 6 point 2 states:

    (2)   Implementations providing password-based authenticated access
           MUST support authentication using CRAM-MD5, as described in 
           section 8.1. 

> In a large scale distributed system, where a given client might bind to 
> many servers, this is totally unmagageable.   

In this environment you probably would not want to use passwords.  And 
therefore, if in your deployment you do not use password-based authenticated 
access, then you would not encounter CRAM-MD5.  You instead might be using 
certificate exchange in Start TLS, for example.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.