[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
R: Re: R: Enforcing attribute ACL on add operations
----- Emmanuel Dreyfus <manu@netbsd.org> ha scritto:
> Pierangelo Masarati <ando@sys-net.it> wrote:
>
> > See ITS#4556 for discussion.
>
> So this is not considered a security hole. But as far as I understand,
> anyone that is allowed to add an entry anywhere can add a user with
> random privileges. Did I miss something here? Can that be avoided?
I'm not necessarily saying that. For the problem you highlight, setting
authz-policy from
would cure it (one could only add an entry and authorize as that entry, but not add an entry and use it to authorize as some other existing one).
What I'm saying that apparently the "right" manner to handle the problem you pose consists in implementing DIT content rules.
p.
Ing. Pierangelo Masarati
OpenLDAP Core Team
SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
-----------------------------------
Office: +39 02 23998309
Mobile: +39 333 4963172
Fax: +39 0382 476497
Email: ando@sys-net.it
-----------------------------------