> -----Original Message-----
> From: Kurt D. Zeilenga [mailto:Kurt@OpenLDAP.Org]
> Sent: Thursday, November 18, 1999 7:01 PM
>
> I recommend that the new bind method (non-SASL) be
> drafted which adapts the algorithm suggested DIGEST-MD5
> to support LDAP DN authorization identities.
I strenuously object to any LDAP-specific authentication protocol being required.
There are dozens of application protocols -- if they all took this approach, it will be in practice impossible to get all of their specific authentication mechanisms correct.
The correct approach to security is to put all your eggs in one basket (or at worst a few baskets) and then guard the baskets very carefully.
Paul