Re: Accessing LDAP attributes inside slapd

[Mark Adamson <adamson@andrew.cmu.edu>]

> Looking at slap_sasl_check_authz() it appears that you can directly call
> backend_attribute() _without_ any connection or operation information to get
> attribute values. Can I rely on this?


If the *conn and *op are NULL the access checking for attributes and
entries is turned off in the backend.  So the backend will "trust" the
front end and give everything asked for.  Just make sure the front end
doesn't hand the attributes back to the LDAP client -- that would bypass
ACLs.


-Mark Adamson
 Carnegie Mellon