Re: [dsml] Questions on bind operation

[rowley@netscape.com (Pete Rowley)]

Title: Message

Jeff Parham wrote:

4AEE3169443CDD4796CA8A00B02191CD03535C30@win-msg-01.wingroup.windeploy.ntdev.microsoft.com">

How does bind operate when processing="parallel"?  If processing="parallel" and onError="resume", does the DSML 2 server continue to issue the remaining operations in the batch request even if the proxy bind fails (or is not supported)? 

I would suggest it does not continue.  Supplying bind credentials implies
that the operations require those credentials in some way, either for access
control purposes or perhaps for binder based server resource limits.  onError="resume"
cannot be honored under the circumstance of bind failure.

4AEE3169443CDD4796CA8A00B02191CD03535C30@win-msg-01.wingroup.windeploy.ntdev.microsoft.com">

Perhaps complicating the answers to these questions is that the only implementation of password-less proxying I'm aware of (Rob's LDAP Proxied Authorization Control -- see attachment in Christine's mail from 8/14) is not an LDAP bind; it's an LDAP control that accompanies individual LDAP operations.  (E.g., does a DSML 2 server that supports the proxied auth control know if the proxy will succeed after processing the bind request or only after issuing a subsequent operation that uses the proxied auth control?)

 

The answer to this is really implementation dependent, however the safe (and
probably most widely implemented) answer is that access status to any particular
resource only becomes known when the operation is performed.

4AEE3169443CDD4796CA8A00B02191CD03535C30@win-msg-01.wingroup.windeploy.ntdev.microsoft.com">

Are multiple bind operations allowed in an envelope?  If so, how does that affect the above?

 

I would suggest not allowing that, it complicates matters.
-- 
Pete Rowley
Developer
Netscape Directory Server