Mailing-List: contact api-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: api@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of elecharny@gmail.com
 designates 209.85.212.50 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:reply-to:user-agent:mime-version:to:subject
         :references:in-reply-to:content-type:content-transfer-encoding;
        b=kxapXtLEw4Gqy/wVNq+uFhz/m9GSn4UZDZnlMNpsjP5VL/CqqBDR9hbD+mRtLL/B2s
         gkspcux0mRaWIYp/oTdXwj3IjNgdu4tfpADXOPDYCB+/noBI1GkuUrCubjX2+Fn9Yl6j
         h0KUt+Iq6hFfRefxgLbbsjyxhM1L58DSMlvxg=
Message-ID: <4B8791F1.5030803@gmail.com>
Date: Fri, 26 Feb 2010 10:18:41 +0100
From: Emmanuel Lecharny <elecharny@gmail.com>
Reply-To: elecharny@apache.org
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
 rv:1.9.1.8) Gecko/20100216 Thunderbird/3.0.2
MIME-Version: 1.0
To: api@directory.apache.org
Subject: Re: Handling M$ specification violations
References: <4B840349.5020902@gmail.com> <4B84433B.2000504@sun.com>
In-Reply-To: <4B84433B.2000504@sun.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

On 2/23/10 10:06 PM, Matthew Swift wrote:
> I think so - I realize that our OpenDS SDK needs to cope with this as 
> well :-(
>
> It makes me wonder what else could be violated? Should we permit 
> non-DNs for all operations? 
IMO, no.

> E.g. modifying the entry "joe.bloggs@example.com"?  It seems a bit 
> inconsistent to be lax in only one part of the protocol but not 
> others. ;-)
There is a difference with the Bind operation DN : for M$, it makes 
sense to enforce their own rule, as they can't ask people to type a DN 
to login (even if they could have used SASL instead of a Simple 
BindRequest). But AFAIK, I don't think you need to 'fix' some other 
request to accept something else than a DN.
>
> My preference is to encourage conformance where possible. What other 
> known violations are there other than the bind DN?
You can rad this very interesting paper from Symas : 
http://www.symas.com/documents/Adam-Eval1-0.pdf

One of the major violation, beside the use of a non-DN in a SimpleBind 
operation is the fact that anonymous authent is not allowed on AD/ADAM 
by default, but this should not be a problem from the API pov, and 
another one is the retrieval of MV attributes that may need a special 
treatment when here are more than 1500 values (and I guess we have to 
deal with this problem...).
-- 

Regards,
Cordialement,
Emmanuel L�charny
www.nextury.com