Meta Idassert-bind

["Andrew Graham" <andrew.graham@agustawestland.com>]

***  Before acting on this email or opening any attachment you are advised to read the disclaimer at the end of this email ***

I've been racking my brains trying to understand the syntax of
idassert-bind. 

In my current setup I have a local bdb database with some users and the
base entry for the tree. I have a meta database that is subordinate to
the bdb database. 

If I bind to the proxy as root, and search for anything, with any base
(within the tree) openldap will bind to the relevant targets using the
credentials defined in the idassert-bind directives. 

If I bind to the proxy as a user that exists locally (within the bdb
database) but not in any of the targets, openldap will bind to the
targets anonymously using the dn defined in idassert-bind but no
password.  

If I bind to the proxy as a user that exists in one of the targets, it
will bind to that target with the supplied credentials, and bind
anonymously using the dn defined in idassert-bind to all other targets
within scope.

Ideally, I would like the following situation:

If a user binds with local credentials, openldap should bind to the
targets with the credentials supplied with idassert-bind. 

If a user binds with remote credentials, openldap should bind to that
target with the credentials supplied by the user, and either bind to the
other targets using the pre-defined credentials OR not attempt to bind
to those targets.

I have tried using 'flags=override', which works well to solve the
local user problem. However if a user binds with remote credentials,
openldap will first bind with those credentials, then rebind with the
pre-defined credentials. The problem here is that the predefined
credentials may not have the same privileges as the supplied
credentials.

Here's something like my slapd.conf...

require authc

access to *
 by dn="cn=user a,dc=example,dc=com" read
 by dn="cn=user b,dc=example,dc=com" read
 by * auth

access to dn.sub="dc=target a,dc=meta,dc=example,dc=com"
 by dn="cn=user a,dc=example,dc=com" write
 by self write


# Meta Database

database        meta
suffix              "dc=meta,dc=example,dc=com"
subordinate

rootdn "cn=root,dc=example,dc=com"

## Target A

uri "ldap://192.168.1.10/dc=target a,dc=meta,dc=example,dc=com"

idassert-bind  bindmethod=simple
                       binddn="cn=ldapproxy,o=example"
                       credentials="secret"
                       mode=none

idassert-authzFrom "dn:*"

rewriteEngine on

suffixmassage "dc=target a,dc=meta,dc=example,dc=com" "o=example"

## Target B

uri "ldap://192.168.1.20/dc=target b,dc=meta,dc=example,dc=com"

idassert-bind  bindmethod=simple
                       binddn="cn=ldapproxy,dc=another,dc=com"
                       credentials="secret"
                       mode=none

idassert-authzFrom "dn:*"

rewriteEngine on

suffixmassage "dc=target b,dc=meta,dc=example,dc=com"
"dc=another,dc=com"


# Local bdb database

database bdb
suffix "dc=example,dc=com"
directory /usr/local/var/openldap-data/example-base/

rootdn "cn=root,dc=example,dc=com"
rootpw "secret"

index objectclass eq
index cn,sn eq,sub


Thankyou for taking the time to read this, any help would be greatly
appreciated.

Best Regards,

Drew


Andrew Graham
ICT
AgustaWestland UK
Tel No: +44 (0) 1935 70 4421
andrew.graham@agustawestland.com

*** Disclaimer ***
The information contained in this E-Mail and any subsequent correspondence may be subject to the Export Control Act (ECA) 2002. The content is private and is intended solely for the recipient(s). 
For those other than the recipient any disclosure, copying, distribution, or action taken, or omitted to be taken, in reliance on such information is prohibited and may be unlawful.

If received in error please return to sender immediately.

Under the laws of England misuse of information that is subject to the ECA 2002, is a criminal offence.

Westland Helicopters Ltd 
Lysander Road 
Yeovil BA20 2YB 
England 

Registered in England under No 604352