Re: More granular privileges in ACLs (Was: (ITS#3625) [enhancement] per-operation ACLs)

[Pierangelo Masarati <ando@sys-net.it>]

Howard Chu wrote:

> > For the realdn, I'm currently assuming that the only place where 
> > identity may change is inside parseProxyAuthz(); I added a o_realndn 
> > field to the operation structure; this field is supposed to be 
> > BER_BVNULL unless proxyAuthz occurred; if it is NULL, the "realdn" 
> > clause, if present, is evaluated using the o_ndn field; if it is not 
> > null, it behaves as expected.  Maybe, in case of SASL bind, we could 
> > store in o_ndn the constructed DN before authz via authz-regexp rules.
>
>
> Does this really belong in op->o_realndn? Perhaps we should have it 
> back in conn->c_dn.

You mean: directly use conn->c_dn instead of copying it in op->o_realndn?

> As for storing the DN prior to authz-regexp, I'm inclined to disagree. 
> The result of regexp mapping is still an authcDN, not an authzDN, and 
> I'm not convinced that we need to refer back to the SASLDN after 
> mapping has been done.
right.

p.


   SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497