Re: SASL External : certificates stored in LDAP

[Michael Ströder <michael@stroeder.com>]

Mitrana Cristian wrote:
>  I think this idea is plain wrong. If the cert will be stored in the
> DIT, what kind of authentication is that ? Every bind operation that
> request a SASL/EXTERNAL will be auth'ed based on the cert, i.e. every
> client that knows a DN which auhtenticates with SASL/EXTERNAL and 
> has the cert stored on the server will can authenticate as the DN.
>  Doesn't this defeat the purpose of the authentication ?
>  Correct my if I'm wrong, just my 2cents.

You still need the appropriate private key for the user certificate during 
connecting with SSL/TLS. This is the credential - not the X.509 certificate 
itself.

Ciao, Michael.