[Date Prev][Date Next]
Re: slapd.conf for proxy to AD
Buchan Milne wrote:
On Wednesday, 9 February 2011 01:13:38 email@example.com wrote:
As far as I recall, what you need is not possible. You can:
- have authenticated users proxied with their identity asserted, or
- all users, including unauthenticated ones auth'd as a fixed identity
but not both. Please note that you're asking OpenLDAP's slapd to bridge
the gap between two broken pieces of code: clients that cannot be
configured to bind,
Because the OP wants to have anonymous access for some clients of the proxy
does not necessarily mean the software is broken, there could be
organisational reasons (e.g. AD administrator not prepared to create multiple
proxy accounts for different applications).
and AD that cannot be configured to accept anonymous
Again, AD can be configured to allow anonymous binds, but AFAIK as of Windows
2003, it is disabled by default, and many AD security standards (used by e.g.
financial auditing companies in their IT auditing) mandate that it not be
Feel free to suggest an enhancement that allows to
handle this scenario, though.
IMHO, it would make sense to support this mode of operation.
Sorry but that just doesn't compute. If you have organizational security
standards that are being audited and they forbid anonymous access, then
allowing anonymous access to an OpenLDAP proxy that connects to AD is going to
be equally forbidden.
Come back with an argument that actually makes sense from a security
perspective first. Otherwise this is just creating back doors to do end-runs
around your sysadmins and company policies.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/