authentication mechanisms question

["Miklos, Sue A." <samiklo@missi.ncsc.mil>]

Please excuse this question if it's already been discussed/resolved - 

In reviewing tha authnLevel options and associated mechanisms, I see
references to sasl (LDAP3).  In tracing back to RFC 2222, EXTERNAL options
are permitted. 

I would like to confirm that the authors agree that there's nothing in this
draft that would preclude the use of an X.509v3 signature certificate as an
'external' authentication mechanism for conveying the DN.

the difficulties associated with managing large numbers of passwords, vice
allowing role name conventions within a certificate has led us to choose the
certificate-based authentication.

regards,
Sandi