[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Limits on anonymous binds

Mark Adamson wrote:
> I was just speaking briefly with Pierangelo Masarati about how to set
> search limits on anonymous binds to slapd. The topic seems to have never
> been resolved, so I'd like to reopen it with a suggestion.  Our mail
> clients here at CMU like to bind anonymously to the LDAP server and do
> expansive searches like "cn=*rs*", which can take forever since the
> substring is shorter than the min substring length.
> I'd just like to be able to define a way to set limits in slapd, without
> touching on anything like what string should be applied as the DN of an
> anonymous bind (e.g. cn=anonymous).  I'd like for the slapd.conf file to
> have one of the following two possibilities:
> limits dn.exact=anonymous <limit>
>   -or-
> limits dn.anonymous  <limit>
> Then if anyone connects and binds anonymously, these limits would apply
> instead of the default limits. get_limits() would still receive the
> parameter  ndn=NULL or ndn="".  It's not much coding in limits.c, I'd just
> to get a feel for what people think of the syntax.

I feel comfortable with both (maybe I prefer the second one).

I note that the present behavior requires one to explicitly
set a target dn when setting a limit, otherwise (non-matching
dn including anonymous) default limits are used.

The proposed change would make anonymous a special case; this 
means we need to explicitly keep track of anonymous limits.

The behavior of the suggested syntax can be reproduced by using
the anonymous limits as default, and by setting non-anonymous 
limits for dn=".+"; this is not much intuitive.

The proposed change would alter what is the usual behavior, in 
that default limits would apply to everybody not explicitly 
limited, except for anonymous.

What should happen if no anonymous limits are set? use default?

My suggestion is first to make clear what default means to the
average user (what's its more intuitive definition) and whom 
the usual, old style limits should apply to: default or 


Dr. Pierangelo Masarati               | voice: +39 02 2399 8309
Dip. Ing. Aerospaziale                | fax:   +39 02 2399 8334
Politecnico di Milano                 | mailto:masarati@aero.polimi.it
via La Masa 34, 20156 Milano, Italy   |