is vulnerability and threat analysis part of the standardization
process ??
RFCs 2251-2256, which specify LDAPv3, carry a stern warning up front that
that these documents lack a standard mandatory-to-implement strong
authentication method, hence limiting the applicability of the protocol
(how much effect this warning has had in practice is hard to say, of
course). New documents have been written that do indeed do a
vulnerability analysis, not in any great depth but enough to motivate the
mechanisms recommended to deal with the identified threats. In particular
see RFC 2829 (which should appear any minute now,
draft-ietf-ldapext-authmeth-04.txt in the mean time).
- RL "Bob"