-------- Original Message -------
Subject: Re: [OpenDS-users] LDAP Password Modify Extended Operation
Date: Mon, 14 Jul 2008 02:37:30 +0200
From: Anton Bobrov <Anton.Bobrov@Sun.COM>
Reply-To: users@opends.dev.java.net
Organization: Sun Microsystems, Inc.
To: users@opends.dev.java.net
References: <487A7E3E.6030207@stroeder.com>
<487A83B3.4010608@sun.com> <487A85F2.3020802@stroeder.com> <487A92DB.3040606@sun.com
> <487A97E8.4010008@symas.com>
yeah, i think it is confusing and should be clarified.
to me [since the same thing used elsewhere] it is what
Kurt did imply, you sure could ask him to comment on
that but as long as its not clarified in the RFC its
somewhat a hanger really. i leave it to Kurt and Ludo
[Ludo, are you reading this ?].
Howard Chu wrote:
Anton Bobrov wrote:
Michael, its mentioned a bit earlier in that RFC, see
"1. Background and Intent of Use" section there which
specifically talks about that and has a reference to
RFC2829 where related to your question see section 9.
"Authorization Identity".
Oddly enough, RFC3062 could have plainly said that the userIdentity
was
an RFC2829 Authorization Identity, but it doesn't. It says it may (or
may not) be an LDAPDN, and LDAPDNs clearly do not begin with a "dn:"
prefix. Maybe this should be clarified in an IETF forum.
Michael Ströder wrote:
Michael Dugan wrote:
Michael Ströder wrote:
I'm testing LDAP Password Modify Extended Operation (RFC 3062)
with
OpenDS 1.0. I just sent the new password in the request, bound as
"cn=Directory Manager". Are there any restrictions?
I get the following error:
---------------------------- snip ----------------------------
Protocol error:
The password modify extended request cannot be processed
because it
contained an invalid authorization ID that did not start with
either
"dn:" or "u:". The provided authorization ID string was "cn=Fred
Feuerstein,ou=People,dc=opends,dc=stroeder,dc=local"
---------------------------- snip ----------------------------
Frankly I don't understand what it says. To me it sounds rather
an
error message related to "Who Ami I? ext. op.".
Since "cn=Fred
Feuerstein,ou=People,dc=opends,dc=stroeder,dc=local"
>
looks like a DN, you
probably need to prefix it with "dn:". For example,
"dn:cn=Fred Feuerstein,ou=People,dc=opends,dc=stroeder,dc=local"
if not it assumes it is not a DN and tries to use an identity
mapper
to process the request.
Could you please point me to the part of RFC 3062 which talks about
adding a "dn:" prefix?
I only found:
------------------------------------------------------------------
PasswdModifyRequestValue ::= SEQUENCE {
userIdentity [0] OCTET STRING OPTIONAL
oldPasswd [1] OCTET STRING OPTIONAL
newPasswd [2] OCTET STRING OPTIONAL }
[..]
The userIdentity field, if present, SHALL contain an octet
string
representation of the user associated with the request. This
string
may or may not be an LDAPDN [RFC2253]. If no userIdentity
field is
present, the request acts up upon the password of the user
currently
associated with the LDAP session.
------------------------------------------------------------------
My understanding is that the server has to detect whether it's a
valid
DN or not and act accordingly.
Ciao, Michael.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@opends.dev.java.net
For additional commands, e-mail: users-help@opends.dev.java.net
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@opends.dev.java.net
For additional commands, e-mail: users-help@opends.dev.java.net
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@opends.dev.java.net
For additional commands, e-mail: users-help@opends.dev.java.net
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
_______________________________________________
Ldapext mailing list
Ldapext@ietf.org
https://www.ietf.org/mailman/listinfo/ldapext