Re: Question re: requirement S3

This is my recollection of some of the discussion we had among the authors when we added S3.  The other authors can chip in if they remember things differently.

First, S3 is not intended to require that servers always accept anonymous replication requests.  It just says that the protocol needs to support such requests if a given pair of servers is configured to use them.  An analogous situation is FTP, where anonymous FTP is supported in the protocol but is
turned of on many FTP servers.  So when you say "of course, there's nothing to prevent someone from trying to initiate one" it seems that we may already be in agreement.

As for the circumstances where it might be useful to have anonymous replication, a set of replicating directory servers on a private net behind a firewall that only lets through LDAP requests would not need authentication among the replicating servers; security in this case has been provided by means
outside of LDAP/LDUP.  These are the same sorts of situations where the confidentiality features might not be needed.  And there may be some situations in setting up a new replica where it is useful to have anonymous replication (see Section 5.1 and 5.1.1 of the MRM draft).

There are certainly many situations where anonymous replication is a very BAD idea.  It should be disabled in such situations.   But it should not be absolutely forbidden in all situations.

Rick Huber

Ed Reed wrote:

> Uppili and I are working on updating the Architecture document (!) and have a question about requirement S3 - The protocol MUST also support the initialization of anonymous replication sessions.
>
> Politely, are you sure?  We would much rather strictly prohibit acceptance of LDUP replication sessions over unauthenticated anonymous connections.  (of course, there's nothing to prevent someone from trying to initiate one, I suppose, but there certainly ought not be any requirement to accept one).
>
> Why is there any reason for any server to ever accept anonymous assertion of replica changes it is supposed to send or receive?
>
> Your clarification will be greatly appreciated.  In the meantime, the architecture document will continue to require authentication for all replication sessions.
>
> Ed and Uppili
>
> =================
> Ed Reed
> Reed-Matthews, Inc.
> +1 585 624 2402
> http://www.Reed-Matthews.COM
> Note:  Area code is 585