[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Using command like tools securely?

--On Monday, June 05, 2006 1:09 PM -0400 Jason Lixfeld <jason+lists.openldap@lixfeld.ca> wrote:


	I'm trying to write some scripts to do various things with ldapadd  and
the like.  What I'd like is to have the script be able to  interface with
the directory without having to specify the binddn and  password in the
script as that could be insecure if someone were to  look at the script.
I don't understand much about the slapd.access (5) and I'm not sure if
limiting access will allow me to do what I want.

How do some of you out there do it?  I don't know much about the
capabilities of SASL, but can SASL be used to authenticate the rootDN
(or some DN that can write) for purposes of writing to the directory?

Yes. We use SASL/GSSAPI, it uses the users kerberos ticket to determine the DN that the user binds as. There is no need to specify any DN or password in scripts.


Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html