Subject: requirement I-D: security considerations

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 08 Apr 2001 22:26:35 -0700

The sentence:
  As noted in Section 3, security may be impacted when replicating
  among servers that implement non-standard extensions to basic
  LDAP semantics.

Section 3 makes no comment upon security.  It does state there
are interoperability issues related to non-standard extensions
but it doesn't discussion what security implications of these
issues.

The sentence:
  Access control is one common case which affects security;
  work to address this issue is going on in LDAPEXT as
  documented in RFC 2820 [RFC2820].

I believe is a false statement.  LDAPext is working on
an access control model for LDAP, but there is no requirement
for this access control model (as stated in RFC2820 or LDAPext's
charter) to address access control in replicated environments.
And, as been noted in both LDAPext and LDUP, the current ACM
I-D states:
  The behavior of the Access Control Model in distributed
  (replicated) environments is beyond the scope of this draft.

I note that any distributed ACM depends upon having a consistent
authentication and authorization model which LDAP [RFC2829]
currently does not provide:
   The method by which a server composes and validates an
   authorization identity from the authentication credentials
   supplied by a client is implementation-specific.

Hence, it is unclear to me how LDUP implementations will
fulfill the LDAP requirement [RFC2251]:
   Servers which perform caching or shadowing MUST ensure that they do
   not violate any access control constraints placed on the data by the
   originating server.

unless significant new work is undertaken or its left to
implementors.   But in regards to the requirements document,
I suggest stating:
   As LDUP replication will be defined after the specification
   of authentication, authorization, and (future) access
   control models, these models do not address implications of
   their use in replicated environments.  Hence, LDUP MUST
   address the implications of replication upon LDAP's
   authentication, authorization, and (future) access control
   models to ensure replicas do not violate access control
   constraints placed upon data by the authoritative
   administrator. 

Kurt