Re: SASL EXTERNAL and client certificates

[Quanah Gibson-Mount <quanah@stanford.edu>]

--On Monday, May 01, 2006 5:16 PM +0200 Adam Pordzik 
<adresseverbummelt@gmx.de> wrote:

> Moin,
>
> Recently, I played with client cerfificated and SASL EXTERNAL mechanism.
> There are some questions left:
>
> AUTHENTICATION/AUTRORIZATION
>
> I can authencticate with any certificate issued by a trusted CA found
> c_rehashed in /etc/ssl/certs. (O'SSL compiled-in certs directory AND
> slapd's TLSCACertificatePath here) Does this implies, that anybody with
> a valid certificate e.g. issued by some public CA like Thwate or Verisign
> is authorized as "users" in ACL terms?
>
> Is only TLSCACertificatePath checked or OpenSSL's default directory also?
>
> If so, how can I prevent this (or turn-off EXTERNAL mechanism completely
> without rebuilding sasl)? For now, this is no problem here at all, but
> 'users' should be a delimited group, not anybody with a valid certificate.

I ran into the same issue with SASL/GSSAPI (anyone who connects with a 
valid K5 ticket from my realm is a "user").  Because of this, I do not use 
"user" anywhere in my ACLs.

However, I also exploit this feature of OpenLDAP to use the SASL DN's of 
connections that do not map into my user space to it so I can give some 
SASL connections read access to various entries without them having entries 
in the database.



> dn:email=me@my.dom,cn=adam pordzik,o=a org
>
> So, DN is in reversed RFC2253 order. That's good, but who flipped it?
> (AFAIK "openssl x509" sub-command also offers a switch to reverse
> subject-DN, but I've never used it so far, therefor I am not sure,
> whether this is only for displaying purposes.)

If you understand DN structure in LDAP (i.e., the order of importance) then 
it should become obvious why the order is reversed to create a valid DN.

> Following works, but I suppose it wouldn't, if I change order of
> attributes names in core.schema:

You should never modify core.schema.


> sasl-regexp
>     email=([^,]*),cn=([^,]*)(,.*)?
>     ldap:///ou=Users,ou=Accounts,dc=my,dc=dom??one?(&(mail=$1)(cn=$2))
>
> $ ldapwhoami -H "ldap://ldap.lan.d-dt.de/"; -ZZ -Y EXTERNAL

I will note that since you have a sasl-regexp (authz-regexp in OL 2.3+), 
you can essentially create a "users" set by doing:

access to <whatever>
  by dn.children="ou=Users,ou=Accounts,dc=my,dc=dom"


(What is dc=dom, by the way? dc=com? :) ).

> So, is there also a possibility to get a sasl bind-dn in the form of
> ...,cn=external,cn=auth, e.g. x509dn,cn=external,cn=auth

Not with SASL/EXTERNAL.  SASL/EXTERNAL uses the DN of the cert.

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html