Re: proxy auth and userpassword access

[Pierangelo Masarati <ando@sys-net.it>]

Dieter Kluenter wrote:

> when using proxy authentication with strong bind, the attribute
> userPassword has to have read access, that is, auth access is not
> sufficient Is there any particular reason for this potential security
> hole?

Well, if you want to use strong auth at the proxy side, the proxy needs
to be able to check the password itself, and this requires the password.

OpenLDAP's proxy is not a SASL proxy, neither my (partial) knowledge of
SASL allows me to state a SASL proxy is at all possible for all mechs.
If it is, adding SASL proxying capabilities to OpenLDAP proxy backends
would be an interesting extension.

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------