[Date Prev][Date Next]
RE: SASL LDAP plugin
> -----Original Message-----
> From: Kurt D. Zeilenga [mailto:Kurt@OpenLDAP.org]
> At 01:54 PM 2002-06-13, Howard Chu wrote:
> okay, then maybe a "who be this?" operation (like whoami but
> asks the question "what DN is associated with this (provided)
> >, so this isn't quite enough. How about a new control
> >mapNameToDN that can accompany any operation, and causes the server to
> >perform the SASL name mapping steps on the request's dn/basedn before
> >handling the request?
> Basically, you'd have a control which would contain an
> authentication or authorization identity (in authzid form).
> The control should be marked critical and the base/target
> DN should be empty. Semantically, the DN associated with
> the provided authzid is used as the base/target DN of the
That sounds good to me. One more question in my mind; this feels like
a control that the frontend should handle, but if we're operating thru a
back-ldap proxy then I'd want to leave it for the backend.
I presume since you say "in authzid form" that the name must have a "u:"
or "dn:" prefix?
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
Symas: Premier OpenSource Development and Support