RE: LDAP PKI Schema (was Re: No-op LDAP ;binary option)

["Steven Legg" <steven.legg@xxxxxxxxxxxxx>]

Michael,

Michael Str der wrote:
> Steve Hanna wrote:
> >>I support the proposal made by Peter Gietz since it seems
> >>like an fairly easy solution to me solving some real-world
> >>problems.
> > 
> > Can't certificateMatch do as well?
> 
> Yes, off course. But it requires implementing it in the 
> server which will 
> take quite some time if ever implemented at all.

Both solutions require implementation effort. The question is
whether the burden of the implementation falls mainly on the
server or the client. The matching rule approach puts the burden
on the server, while the child entry approach puts the burden on
the clients.

Regards,
Steven