[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: SASL / DIGEST-MD5



Hi Quanah,

Le ven 14/03/2003 à 15:22, Quanah Gibson-Mount a écrit :
> Francois,
> 
> When you first bind to the ldap server, it has no idea who <you> are.  So 
> what happens is that you are at first seen as an "anonymous" user in the 
> initial stages of the authentication process.  Since you are not giving 
> search access to the objectclass it needs to figure out who you are, it is 
> ending.
> 

You are right, it's an ACL problem because if I have a "access to * by *
read" it works :)

Thank you very much, but with your ACLs I still can't authenticate

> Also, your ACL's are likely incorrect in their arrangement.  If you want 
> cn=root,dc=enatel,dc=local to have write access to your entire tree, they 
> should look like:
> 
> access to dn.base=""
>         by * read
> 
I don't really understand this ACL
you grant read access on empty entry ?
Is this used to list the DNs of the directory ?

> access to *
>          by dn.base="cn=root,dc=enatel,dc=local" write
>          by * break
> 
are you sure of the line "by * break" ?
I believe that break should be used in addition to an access granted
Maybe you meant "by * read break" ?

> access to dn=".*,ou=people,dc=enatel,dc=local"
>          by self write
>          by dn.base="cn=root,dc=enatel,dc=local" write
>          by * none
> 

I have to add "by anonymous search" in the third ACL to get it working
And after that I can comment the first ACL without effect

Francois

> 
> --
> Quanah Gibson-Mount
> Senior Systems Administrator
> ITSS/TSS/Computing Systems
> Stanford University
> GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html
>