Tradeoffs arise from the relationships within and among identifiers, authentication, and directories. Some identifiers have associated authentication mechanisms. For example, the netID category of identifier usually has a password authentication process. And increasingly there are mappings between authentication processes. For example, one may want to use a Kerberos password to move an X.509 key from a central store to a local machine.
Identifiers serve as the primary indices into directories.
Directories need security to permit and protect user access and hence require some form of authentication process themselves. These relationships fundamentally compound design issues. For example, locally unique identifiers can be problematic in global directory schema. It is desirable that a compromise of the security system of the directory not compromise other authentication processes. Identifiers should be chosen to facilitate authentication mechanisms.