RE: checking for bound user

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: owner-openldap-devel@OpenLDAP.org
> [mailto:owner-openldap-devel@OpenLDAP.org]On Behalf Of Pierangelo
> Masarati

> > That's a big help. I was only looking at the bind.c code, and didn't
> > notice the op->o_conn->c_dn being set. Thanks.
>
> Howard's note is that you should use op->o_ndn; in fact,
> in some cases backend search routines are called out of
> context for internal purposes; in this case, they might
> have a null or fake connection, so op->o_ndn should be
> guaranteed to be set to the identity the operation is
> supposed to run as.  During regular operations, op->o_ndn
> and op->o_conn->c_ndn should be exactly the same.

There's also the case of requests using the proxyAuthz control. All of
slapd's internal identity checks (e.g., for ACLs) use op->o_ndn; this is the
identity that matters.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support