Re: RFC2256: userPassword

[dboreham@netscape.com (David Boreham)]

JR Heisey wrote:

> My problem with this is that it gives the third party
> software access to all of my (assuming I'm the accounting
> system user) access to LDAP user information and possibly
> access to anything else that I have rights to. Which may or
> may not be a problem.

This is a fair comment.

Whenever I've heard this problem mentioned,
the most obvious solution was to define an
LDAP operation for proxy authentication.
(works like bind, but just tells the client
whether the bind would have succeeded,
rather than actually binding).

You can probably use access control to
work round the problem by setting a rule
to deny access to entry contents when
the client connects from a particular
host and port. I've never
seen anyone do that in the field.