Subject: Re: unsolicited controls (Was: I-DACTION:draft-weltman-ldapv3-auth-response-01.txt)

From: "Jim Sermersheim" <[email-masked]>
Date: Wed, 09 Feb 2000 19:03:44 -0700

Given this definition, what constitutes extraordinary? Is an expired password an extraordinary condition? Unless we can define the meaning of extraordinary, I'd rather just decide to allow unsolicited response controls or not.

>>> "Kurt D. Zeilenga" <[email-masked]> 2/9/00 4:15:26 PM >>>
RFC 2251, 4.4 (unsolicited notifications) says:
   It [an unsolicited notification] is used to signal an
   extraordinary condition in the server or in the connection
   between the client and the server

I believe the same should apply to unsolicited controls:
  An unsolicited response control is used to signal an
  extraordinary condition with the operation.

That is, the fact that an identity is authorized is by a
operation bind is quite ordinary and hence a client shouldn't
be notified of the identity unless explicitly requested.

Kurt

At 10:53 AM 2/9/00 -0800, Kurt D. Zeilenga wrote:
>At 10:11 AM 2/9/00 -0800, David Boreham wrote:
>>
>>Examples ?
>
>draft-weltman-ldapv3-auth-response-01.txt
>draft-behera-ldap-password-policy-00.txt
>
>I feel the client should be required to take some explicit
>action before the returns any response not described by
>the core specifications.  This act may be an explicit
>request control, a control upon bind enabling the behavior
>for the "session", an extended operation enabling the behavior,
>or some other form of solicitation.
>
>I feel a server should not respond with controls and/or
>extended responses not detailed by the core specifications
>without such solicitation.
>
>That is, the client should
>	1) discover what protocol extensions are supported by the server
>	2) enable desired extensions
>
>A server should:
>	1) published supported extensions
>	2) disable all extensions until enabled by the client
>
>
>

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 09 Feb 2000 19:41:41 -0800

Is their a compelling reason to not negotiate these elective
features?  I believe it is unwise not to negotiate elective
features.

At 07:03 PM 2/9/00 -0700, Jim Sermersheim wrote:
>Given this definition, what constitutes extraordinary?

Good question.  Ask?
	Is the importance of the notification such that most
	applications would be modified to recognize it and
	do something reasonable because of it?

If the answer is no, than it's not extraordinary.

> Is an expired password an extraordinary condition?

Per my above definition, no.

In the case of password policy, I'd suggest a bind control that
the client could use to tell the server, "I recognize password
policy controls/responses".  This is a form of solicitation.

> Unless we can define the meaning of extraordinary,
> I'd rather just decide to allow unsolicited response controls or not.

Even though I am hard pressed at the moment to find a control
extraordinary enough that application developers would be compelled
to update their codes to recognize it, I would hate to disallow
unsolicited response controls completely as I believe that
the recommended use of unsolicited controls should be comparable
to unsolicited responses.

	Kurt