Re: Authentication Methods for LDAP - last call

[Steve Kille <S.Kille@isode.com>]

Tim,

I'd like to respond briefly to your summary.   To me, John Strassner's 
rebuttal of Chris Newman's message sets out clearly the case against a 
single mandtory authentication mechanism.

Basic LDAP client/server interoperability can be and is achieved 
without authententication.   I cannot see what specifying this single 
mandatory mechanism achieves.

If I had to pick a single mechanism it would be X.509 based.  Kerberos 
would be better than CRAM-MD5. 

Making CRAM-MD5 mandatory will promote an approach which a lousy choice 
for many many environments.  

To me the clear conclusion is that there should not be a mandatory 
mechansism.  


Steve Kille