> -----Original Message-----
> From: Kurt D. Zeilenga [mailto:Kurt@OpenLDAP.Org]
> Sent: Monday, November 15, 1999 12:01 PM
> To: Curtin, William
> Cc: Curtin, William; ietf-ldapext@netscape.com
> Subject: RE: AuthzIDs or DNs, but not both
>
>
> At 02:54 PM 11/15/99 -0500, Curtin, William wrote:
> >> Basically, I propose that when a user enters "kdz" as an
> authorization
> >> string that the client uses the DN "authzid=kdz"
> >
> >[do you mean RDN authzid=kdz?
>
> No. I mean the DN "authzid=kdz". That is, the DN as only one
> component.
This isn't a legal DN. (Not that I care very much, but some people care really a lot, and we work by rough concensus around here...)
Even if it were, it doesn't provide much if any added value over saying that the authzid is a UTF-8 string.
If this is going to prove such a bother, I would just prefer that the whole authzid thing got yanked. I think its a bad idea to let anyone (even an admin) just declare that they want to be someone else. A bad idea in that I think its ripe for security abuse.
Paul