Issue 9003 - Update slapd-ldap(5) idassert-authzfrom for policy difference
Summary: Update slapd-ldap(5) idassert-authzfrom for policy difference
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: documentation (show other issues)
Version: 2.4.47
Hardware: All All
: --- normal
Target Milestone: 2.4.50
Assignee: Quanah Gibson-Mount
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-04 16:07 UTC by Quanah Gibson-Mount
Modified: 2020-04-28 16:56 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this issue.
Description Quanah Gibson-Mount 2019-04-04 16:07:37 UTC 
Full_Name: Quanah Gibson-Mount
Version: 2.4.47
OS: N/A
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (47.208.144.40)


The slapd-ldap(5) man page has the following statement:

       idassert-authzFrom <authz-regexp>
              if  defined,  selects  what  local  identities are authorized to
              exploit the identity  assertion  feature.   The  string  <authz-
              regexp>  follows  the rules defined for the authzFrom attribute.
              See slapd.conf(5), section related to authz-policy, for  details
              on the syntax of this field.

However, it deviates from the rules laid out in the authz-policy section in that
the special case of "*" has a different meaning for slapd-ldap/slapd-meta.  In
their case, this *allows* anonymous, while in the authz-policy case, anonymous
is denied.  This exception to the normal behavior needs to be noted.
Comment 1 OpenLDAP project 2019-06-17 14:56:10 UTC 
has patch;IPR OK
openldap-scratch
Comment 2 Quanah Gibson-Mount 2019-06-17 14:56:10 UTC 
changed notes
moved from Incoming to Documentation
Comment 5 Quanah Gibson-Mount 2020-04-01 19:41:40 UTC 
Commits: 
  • a5b8a41c 
by Quanah Gibson-Mount at 2020-04-01T19:40:27+00:00 
ITS#9003

Note that with slapd-ldap, the special character "*" actually allows anonymous rather than denies, as is the case with authz-policy
Comment 6 Quanah Gibson-Mount 2020-04-02 21:33:16 UTC 
 • 468c8ee2 
by Quanah Gibson-Mount at 2020-04-02T21:18:24+00:00 
ITS#9003

Note that with slapd-ldap, the special character "*" actually allows anonymous rather than denies, as is the case with authz-policy