Re: SASL Semantics Within LDAP

> As I wrote in that old message (a bit less clearly:‑), I wonder if both 
> the quoted text and the original authmeth DIGEST‑MD5 text is too strict, 
> though I didn't know what to do about it at the time: 
> 
> Formally, I imagine the server could regard <cn=Bob,...> and 
> <cn=bob,...> as different DIGEST‑MD5 usernames which have the same 
> password:  Since the username => password mapping in the example is 
> implemented in LDAP, the mapping has LDAP semantics. 
> 
> For DIGEST‑MD5, that would only work if the server stores the password 
> as plaintext so it can hash it with the username provided by the client. 
> It won't work if what the server stores is a hash of (password, DN, 
> realm). 

I think this example will be OK because it is correct (to the best of my knowledge) and it isn't meant to exhaustively enumerate the issues with DIGEST-MD5 semantics relative to LDAP such as the method used to generate a hash value. 

Roger