Re: proxy auth and userpassword access

[Howard Chu <hyc@symas.com>]

Pierangelo Masarati wrote:
> Dieter Kluenter wrote:
>
> > when using proxy authentication with strong bind, the attribute
> > userPassword has to have read access, that is, auth access is not
> > sufficient Is there any particular reason for this potential security
> > hole?
>
> Well, if you want to use strong auth at the proxy side, the proxy needs
> to be able to check the password itself, and this requires the password.
>
> OpenLDAP's proxy is not a SASL proxy, neither my (partial) knowledge of
> SASL allows me to state a SASL proxy is at all possible for all mechs.
> If it is, adding SASL proxying capabilities to OpenLDAP proxy backends
> would be an interesting extension.

Given that the worthwhile SASL mechanisms are designed to resist 
man-in-the-middle (MITM) attacks and a proxy is essentially a MITM, I'd say 
it's not going to happen. The proxy needs to have as much knowledge as the main 
server.
--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP     http://www.openldap.org/project/