Subject: Re: comments: draft-weltman-ldapv3-proxy-05.txt

From: Rob Weltman <[email-masked]>
Date: Wed, 01 Nov 2000 08:56:44 -0800

Kurt,

  I have taken into account your comments in a new draft which I will be submitting shortly. But there are a couple of points I disagree with (or don't fully understand). See below.

Rob

"Kurt D. Zeilenga" wrote:
> 
> The syntax of controlType should be LDAPOID and have
> the value of the assigned OID.

  That's part of the control spec of RFC 2251 (section 4.1.12), not something that can be defined by an individual control.

> 
> I suggest you add a statement that servers recognizing this
> control MUST return an error if the control is not marked
> as being critical.

  The draft defines the syntax of the control, including the required criticality. I don't think this case is different from any others - the server should reject invalid syntax.

> "This means that fewer results, or no results, may be returned"
> I assume you meant fewer entry and references responses, not
> results.

  Search results consist of entries and references.

> 5. Security Considerations
> 
> A more detailed security analysis may be appropriate.  In
> particular of dangers of using this control in environments
> without appropriate integrity and confidentiality protections
> The risk of a control being added/modified/removed in transit
> should be briefly discussed.

  If the control is used in an environment where it's contents can be altered by an intruder, the intruder can do much worse things than add/alter/remove a proxied auth control. The intruder can change the results returned by the request (including making it fail altogether or succeed where it wouldn't have otherwise) by adding/altering/removing the control, but it could do so by adding/altering/removing any other part of the request as well. An intruder can't grab proxy rights for himself/herself without being an authentication identity entitled to proxy rights. So I think the integrity issues are covered with the text in the draft:

"The Proxied Authorization Control method is subject to standard LDAP
security considerations. The control may be passed over a secure as
well as over an insecure channel."

  I'm adding a sentence about the control including an additional identity, which may be of concern in some environments.

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Wed, 01 Nov 2000 10:15:37 -0800

>  I have taken into account your comments in a new draft which I will be submitting shortly. But there are a couple of points I disagree with (or don't fully understand). See below.

I look forward to your new draft.  Below is clarification which
may be useful.

>  That's part of the control spec of RFC 2251 (section 4.1.12), not something that can be defined by an individual control.

It's just your notation seems odd (incorrect) to me.

You say:
   proxyAuthControl ::= SEQUENCE {
           controlType     2.16.840.1.113730.3.4.12,
           criticality     BOOLEAN DEFAULT FALSE,
           controlValue    proxyAuthValue
   }

I believe you mean:
   proxyAuthControl is a Control [RFC2251] where the controlType
   value is "2.16.840.1.113730.3.4.12" and the controlValue is
   an BER encoded proxyAuthValue.

but what you said is different.

>  The draft defines the syntax of the control, including the required criticality. I don't think this case is different from any others - the server should reject invalid syntax.

RFC 2251 specifically states when unavailableCrititialExtension result
code should be returned.  In particular, if the control type is
recognized and is appropriate for the operation, the value MUST be
used regardless of the criticality field and, IMO, without regard to
the criticality field.  That is, if the server determines that value
to be used is invalid, it should return some error indicating this.
This behavior should not be dependent on whether the control was
marked as critical or not.

>  Search results consist of entries and references.

This is a nit... but to clarify: A search request in a result.
This result consists of entries and references, and a done message.
When you say "fewer results", I don't read this as "fewer entries
and messages messages", hence my suggestion that you clarify.

Kurt