[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: by users in <WHO> field

To: Michael Ströder <michael@stroeder.com>
Subject: Re: by users in <WHO> field
From: Howard Chu <hyc@symas.com>
Date: Thu, 01 Apr 2010 12:58:19 -0700
Cc: openldap-software@openldap.org
In-reply-to: <4BB4C08B.8090703@stroeder.com>
References: <4BB4C08B.8090703@stroeder.com>
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; rv:1.9.3a4pre) Gecko/20100331 Firefox 3.6

Michael Ströder wrote:

HI!

I have some doubts about ACLs containing "by users" and the term
"authenticated clients" used in the man pages: If I bind with SASL/EXTERNAL
(e.g. over LDAPI) and the authc-DN does *not* map to an authz-DN of a real
directory entry what does "by users" then mean exactly?


It means anyone who has successfully authenticated, by any means.

It seems that slapd grants access with clause "by users" but I feel this is
wrong. I'd prefer if "users" would mean fully-identified clients mapped to a
real entry.


No. Such a restriction would prevent distributed authentication from ever working.


I saw that slapd.access(5) also mentions "realusers" for the<WHO>  field but
using this instead of "users" makes no difference.

Obviously that's not what it means. The "real" prefix specifies the real userwhen proxy authorization is in effect.


--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/

Follow-Ups:
- Re: by users in <WHO> field
  - From: Quanah Gibson-Mount <quanah@zimbra.com>

References:
- by users in <WHO> field
  - From: Michael Ströder <michael@stroeder.com>

Prev by Date: by users in <WHO> field
Next by Date: Re: by users in <WHO> field
Index(es):
- Chronological
- Thread