[Date Prev][Date Next]
Re: cannot authenticate as user himself
Just as follow-up, I have done more investigation and discovered that
disregarding the fact that op->o_dn and ndn are cleared by bind.c,
op->o_dn and ndn are never set to user's dn until he authenticates. But
of course that is too late! I further wondered why this worked in 1.x
and not now and realized that in 1.x no acl checking was done on a bind.
Am I off base?
Yoel Spotts wrote:
> To all,
> I have an issue which I think is a bug, but would first like to present
> it in "software" as the error might be my own:
> I am using openldap-2.0.7.
> I have the following line in my slapd.conf:
> access to dn=".*,ou=users,o=top"
> by self write
> I get an LDAP_INSUFFICIENT_ACCESS when I try to bind as a user (lets say
> "uid=yoel,ou=users,o=top"). (Yes, the password is correct). If I have
> write permission, I should have auth permission.
> I have stepped through the process and have found the following:
> in acl.c in function acl_mask on line 398 (in the code I have) is where
> the acl that I have set up is handled. On the next line, we make sure
> op->o_ndn and op->o_dn are not NULL or empty strings. When I stepped
> through using a debugger, these values were empty strings, even though
> the dn should be "uid=yoel,ou=users,o=top". When I investigated a bit
> further, I found that in /servers/slapd/bind.c toward the beginning of
> the funciton, op->o_dn and op->o_ndn are cleared and set to empty
> strings. I would imagine this is the reason the acl fails. Is it
> possible that those should be the connection dn's, i.e. we should be
> clearing conn->c_dn and conn->c_ndn?
> If anyone can help, let me know if I made a mistake or if I should post
> this to the bugs list.
> Yoel Spotts email@example.com
> VASCO Data Security, Inc. http://www.vasco.com
Yoel Spotts firstname.lastname@example.org
VASCO Data Security, Inc. http://www.vasco.com