Re: View or filter based on ldaps://FQDN

[Ronie Gilberto Henrich <ronie@ronie.com.br>]

Howard Chu wrote:
> Ronie Gilberto Henrich wrote:
>> Hello,
>>
>> I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server.
>> Let say I have the following in my ldap server:
>> ou=domain
>>      ou=raincoatcompany.com
>>      ou=umbrellacompany.com
>>
>> Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10
>> So, querying the ldap server using ldaps://ldap.raincoatcompany.com/ou=domain should grant access only to the following:
>> ou=domain
>>      ou=raincoatcompany.com
>>
>>
>> Is there any way to accomplish that with OpenLDAP?
>
> Not possible. slapd only sees the IP address of the incoming connection, it has no way to know what DNS name was used to resolve to that address.
>
Is it possible to allow access to a specific dn only by a specific client IP address?
ie:
access to dn.exact="ou=domain,ou=raincoatcompany.com"
    by clientIP=200.200.0.117 read