Subject: RE: WG Last Call on the LDAPv3 Directory Replication I-D

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 15 Feb 2001 23:02:29 -0800

Section B.3 discusses replication issues due to schema
mismatches.  

I note that even with a common schema, servers
may have different requirements for schema management.
1) schema may not be updatable via LDAP
2) server may require a common schema, instead of
   per administrative area schema
3) schema may be held in an entry, not a subentry.

Also, one must be careful not to replicate schema descriptions
which are indicative of support for specific features, such
as extensibleObject.

Also, there seems to be similar replication issues
due to other "feature" differences between two LDAPv3 servers.

Including:
- subtypes may not be supported, or supported with restrictions
- schema entry v. schema subentry
- different ;binary use restrictions
- extensions (e.g. language tags, dynamic objects)
- [structural] object class modify
- extensible object support

The I-D notes that a Standard Track ACM is needed.  I note that
the ACM model under development by LDAPext may be insufficient
in replicated environments (but that's another thread).   One
likely also needs a Standard Track referral representation.

I note that there need not be a requirement that replicas
implement the same access control model.  The requirement
is (RFC 2251, 3.2):
   Servers which perform caching or shadowing MUST ensure that they do
   not violate any access control constraints placed on the data by the
   originating server.

That is, it's the policy that counts, not the model.

Editorial, I dislike the use of "Standard" when referring
to documents which are not Standards.  I suggest replacing
"Standard" with "Specification" or "Technical Specification".

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 19 Feb 2001 14:36:37 -0800

John,

The post you refer to was introductory.  I did post some more
specific comments, in particular regarding:
	"equally capable" and "access control"
	  requirements up replicas (RFC 2251)
	Security Considerations and RFC 2820

I'll recap briefly here and repost as these comments might
have been overlooked as they were buried in another thread.

In the former, I think the requirement I-D needs to
state that "application-level interoperability" is will not be
guaranteed by the protocol, but may be resolvable by
applicability statements (profiles).  In the end, "application
interoperability" requires that all replicas implement the
same features in the same manner and this, IMO, is beyond
the scope of LDUP.

In the latter, I note that Security Considerations section
is saying specific issues are being addressed in RFC 2820
(and the work in progress) when this is clearly not the case.

Also, I note my opinion that LDUP specifications can be
progressed without a Standard Track ACM.  First, there
are other ways to meet the "access control" requirements
set forth in RFC 2251.  Second, LDAP ACM does not guarantee
that all implementations are "equally capable".

I would be happy to elaborate on these issues as necessary.

Kurt