Re: Extension: WG Last Call: draft-ietf-ldapbis-authmeth-15.txt

Section 3.1.4 Discovery of Resultant Security Level
This refers to 3.2.3 which does not exist. I can't tell what it was 
intended to reference.

Also there are many references to [Protocol] section 4.13.x.x which 
probably should now be 4.14.xx.

Section 3.1.5 Server Identity Check
This section talks about how a client must verify a server's name 
against the identity presented in the server's certificate. This clause
 - The "*" wildcard character is allowed in the server name
       provided by the user.  If present, it matches only the left-most
       label from the subjectAltName.
makes no sense to me. That implies that I can issue an ldap request to 
e.g. ldap://*.example.com, which at a glance means to perform a DNS zone 
transfer against example.com and then issue an LDAP query against every 
DNS host record that's returned. I don't see how it makes any sense for 
a user to provide wildcarded server names to a client. In RFC2830 it was 
clear that wildcard characters could be present in the certificate, and 
that usage makes sense. Why is the use of wildcards reversed here? This 
invalidates many already-deployed RFC2830-conforming server 
certificates, if nothing else.

Section 3.3
2nd bullet
        "confidentially" should be "confidentiality"

Kurt D. Zeilenga wrote:
> The WGLC will now close on Tuesday, 27 September 2005.
> It is hoped that this extension will allow for additional
> review and comment.  If you haven't commented already,
> please take some time in the next few days to do so.
>
> Thanks, Kurt
>
> At 10:27 AM 9/19/2005, Kurt D. Zeilenga wrote:
> > Please note this WGLC closes this Thursday!  Please review
> > and comment (and if you have no comments, drop a note to
> > chairs so).
> >
> > -- Kurt
> >
> > At 01:10 PM 9/6/2005, Kurt D. Zeilenga wrote:
> > > This message initiates a LDAPBIS Working Group Last Call on the
> > > document:
> > >
> > >  Title:     LDAP: Authentication Methods and 
> > >             Connection Level Security Mechanisms
> > >  Editor:    R. Harrison
> > >  Filename:  draft-ietf-ldapbis-authmeth-15.txt


--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc
  OpenLDAP Core Team            http://www.openldap.org/project/