Subject: RE: Does Slime works fine with Windows 2000 PKI

From: "Alan Shepherd" <[email-masked]>
Date: Thu, 15 Jun 2000 10:15:19 +0100

I'm jumping in too!  I'd like to add that we have deployed the MaxWare LDAP
proxy server for just this role in a large corporate in the UK.  They have a
PKI and wish to communicate externally using certificates from it, so we use
the MaxWare software to control access to the directory information,
specifically only allowing searches on mail addresses and the retrieval of
certificates.  This means that all other information in the corporate
directory is still secure.

Alan Shepherd.

> -----Original Message-----
> From: Frank W. Nolden [mailto:[email-masked]]
> Sent: 11 May 2000 16:17
> To: Walter Williams; Laurent Deffranne
> Cc: ietf-smime
> Subject: Re: Does Slime works fine with Windows 2000 PKI
> 
> 
> Sorry for jumping into this discussion, which I find very 
> interesting. There
> is a way of publishing certificates to the outside world 
> without opening up
> the AD. I think Walter mentioned in already and that is 
> replicating only the
> certificate information (with some minor additional information like
> emailaddress, distinguished name, surname, tc) to an (LDAP) 
> directory that
> is connected to the internet. Replicating this information 
> cannot be done
> using the standard X.500 DISP protocol since Microsoft does 
> not support
> that, but you can use LDIF files and other more sophisticated 
> tools like our
> MaXware Directory Sync Engine. You could put LDAP proxy 
> servers (MaXware
> also has these available as Innosoft does) in front of that 
> for security
> purposes and attribute mapping.
> 
> A major advantage is that you do not permit anyone in real 
> time either via a
> proxy or not to access information in the AD. An extra (LDAP) 
> directory is
> an extra security barrier to your AD and it will only publish the
> information you want to be available on the web, without 
> risking access to
> your AD and without configuring the Access Control in AD.
> Regards,
> 
> Frank Nolden
> 
> 
> 
> ----- Original Message -----
> From: "Walter Williams" <[email-masked]>
> To: "Laurent Deffranne" <[email-masked]>
> Cc: "ietf-smime" <[email-masked]>
> Sent: Thursday, May 11, 2000 15:57
> Subject: RE: Does Slime works fine with Windows 2000 PKI
> 
> 
> > Active directory would expose a significant amount of 
> information you
> might
> > not want the external world to know, such as a complete 
> listing of all
> your
> > w2k computers and their roles in your network.  You could 
> use a LDAP proxy
> > server to provide what you want to the internet and keep the data in
> active
> > directory.  Innosoft (Now purchased by IPlanet) makes such 
> a product.
> There
> > are probably others on the market.
> >
> > > -----Original Message-----
> > > From: Laurent Deffranne [mailto:[email-masked]]
> > > Sent: Thursday, May 11, 2000 9:48 AM
> > > To: walter.williams
> > > Cc: ietf-smime
> > > Subject: RE: Does Smime works fine with Windows 2000 PKI
> > >
> > >
> > > What would happen if you want to open the directory to anonymous
> > > access to the Web ?
> > > In such a way that you could exchange S/MIME certs with 
> outside people ?
> > >
> > >
> > >
> > >
> > >
> > >
> > > walter.williams%genuity.com@Internet
> > > 11/05/2000 15:35
> > > To: Laurent Deffranne/GKBCCB@GKBCCB
> > > cc: ietf-smime%imc.org@Internet
> > >
> > > Subject: RE: Does Smime works fine with Windows 2000 PKI
> > >
> > > Let me take the points one at a time and inline:
> > >
> > > > -----Original Message-----
> > > > From: Laurent Deffranne [mailto:[email-masked]]
> > > > Sent: Thursday, May 11, 2000 9:19 AM
> > > > To: walter.williams
> > > > Cc: ietf-smime
> > > > Subject: RE: Does Smime works fine with Windows 2000 PKI
> > > >
> > > >
> > > > Walt,
> > > >
> > > > Do you mean that there are difficulties to access 
> through LDAP an
> > > > Active Directory, as you want to read or use X509 certificates ?
> > > >
> > >
> > > No.  However, are you going to open your active directory to
> > > anonymous LDAP
> > > queries over the Internet?  If not, are you limiting S/MIME to
> > > internal use
> > > only?  If not then you are somewhat back to square one.
> > >
> > > > By the way,does somebody know issues about Active 
> Directory LDAP,
> > > > or issues to read a certificate in an Active Directory ?
> > >
> > > This worked just fine for us here, but the problem we had 
> with AD was
> that
> > > it does not support inetOrgPerson, and thus can't easily be
> > > synched up with
> > > most external LDAP directories.  You'll find you'll want 
> a metadirectory
> > > connector to synch it with any external directory.  
> Again, this is not
> an
> > > issue if you're willing to directly expose AD to internet use.
> > > >
> > > > For me it would be a mistake to use now the "brand new" Active
> > > > Directory, but if someone could tell me where I can find proofs
> > > > of lack of compatibility (from Microsoft, there must be surely
> > > > one of two), this would interrest me.
> > > >
> > > AD seems to work just fine, if you don't mind working with
> > > something with a
> > > proprietary schema.  Any LDAP and S/MIME aware client we 
> pointed at it
> > > understood the contents just fine, so the schema does not 
> seem to impact
> > > client interoperability.
> > >
> > > > Laurent
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > walter.williams%genuity.com@Internet
> > > > 11/05/2000 14:54
> > > > To: Laurent Deffranne/GKBCCB@GKBCCB, ietf-smime%imc.org@Internet
> > > > cc:
> > > >
> > > > Subject: RE: Does Smime works fine with Windows 2000 PKI
> > > >
> > > > Laurent;
> > > >
> > > > Yes, certs issued from a W2K CA can be used for S/MIME, and no
> > > > less so than
> > > > certs issued from Baltimore, Iplanet or any other CA vendor or
> > > > product.  The
> > > > main issue is not will they work, but will you be able 
> to validate the
> > > > certs.  Unless the person issuing the cert from W2K has
> > > provided you with
> > > > their server's cert, or they have certified their CA with the
> > > signature of
> > > > the publicly known CAs you will not be able to easily verify
> > > the signature
> > > > to its source.  This is not the most technically acurate way of
> > > > saying this
> > > > but I'm not awake yet.  Baltimore has preregistered 
> there CA with the
> > > > vendors distributing products, as has Verisign, Thaught, and
> > > many others.
> > > > Just make certain that you have the certificates for the W2K CA,
> > > > and access
> > > > to its revocation list so you can validate properly and 
> you'll be
> fine.
> > > >
> > > > Walt Williams
> > > > TSD-Systems
> > > > Senior IT Analyst
> > > > Genuity
> > > > www.genuity.com
> > > >
> > > > Please note: GTE Internetworking is now Genuity.
> > > >
> > > > > -----Original Message-----
> > > > > From: [email-masked]
> > > > > [mailto:[email-masked]]On Behalf Of 
> Laurent Deffranne
> > > > > Sent: Thursday, May 11, 2000 5:45 AM
> > > > > To: ietf-smime
> > > > > Subject: Does Smime works fine with Windows 2000 PKI
> > > > >
> > > > >
> > > > > Hi everybody,
> > > > >
> > > > > Just a question :
> > > > >
> > > > > Is there any known issues using S/MIME with 
> Win2000PKI-certificates
> ?
> > > > > More generally, are Win2000 certificates usable with (and
> > > > > understood by ) the others mailers (especially Lotus Notes,
> > > > > Netscape, Eudora +plug-in?)
> > > > >
> > > > > Isn't Baltimore Unicert a "better choice" due to its greater
> > > > > compatibility ?
> > > > >
> > > > > Any advices are welcome.
> > > > >
> > > > > Regards,
> > > > >
> > > > > Laurent Deffranne
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> > >
> >
> >
> 
> 

------------------------------------------------------------------------------------------
This message is for the named person’s use only.  It may contain confidential, proprietary or legally privileged information.  No confidentiality or privilege is waived or lost by any mistransmission.  If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender.  You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. PROTEK Network Management Group and each of its subsidiaries reserve the right to monitor all e-mail communications through its networks.  Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity.