Re: Using command like tools securely?

[Quanah Gibson-Mount <quanah@stanford.edu>]

--On Monday, June 05, 2006 1:09 PM -0400 Jason Lixfeld 
<jason+lists.openldap@lixfeld.ca> wrote:

> Hi,
>
> 	I'm trying to write some scripts to do various things with ldapadd  and
> the like.  What I'd like is to have the script be able to  interface with
> the directory without having to specify the binddn and  password in the
> script as that could be insecure if someone were to  look at the script.
> I don't understand much about the slapd.access (5) and I'm not sure if
> limiting access will allow me to do what I want.
>
> How do some of you out there do it?  I don't know much about the
> capabilities of SASL, but can SASL be used to authenticate the rootDN
> (or some DN that can write) for purposes of writing to the directory?

Yes.  We use SASL/GSSAPI, it uses the users kerberos ticket to determine 
the DN that the user binds as.  There is no need to specify any DN or 
password in scripts.

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html