https://bugs.openldap.org/show_bug.cgi?id=9211
Bug ID: 9211 Summary: Relax control is not consistently access-restricted Product: OpenLDAP Version: 2.4.49 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: slapd Assignee: bugs@openldap.org Reporter: ryan@openldap.org Target Milestone: ---
The following operations can be performed by anyone having 'write' access (not even 'manage') using the Relax control:
- modifying/replacing structural objectClass - adding/modifying OBSOLETE attributes
Some operations are correctly restricted: - adding/modifying NO-USER-MODIFICATION attributes marked as manageable
(Modification of non-conformant objects doesn't appear to be implemented at all.)
In the absence of ACLs for controls, I'm of the opinion that all use of the Relax control should require manage access. The Relax draft clearly and repeatedly discusses its use cases in terms of directory _administrators_ temporarily relaxing constraints in order to accomplish a specific task.
https://bugs.openldap.org/show_bug.cgi?id=9211
Ryan Tandy ryan@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9204
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |9204 See Also|https://bugs.openldap.org/s | |how_bug.cgi?id=9204 |
Referenced Bugs:
https://bugs.openldap.org/show_bug.cgi?id=9204 [Bug 9204] slapo-constraint allows anyone to apply Relax control
https://bugs.openldap.org/show_bug.cgi?id=9211
Ryan Tandy ryan@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|bugs@openldap.org |ryan@openldap.org
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |2.6.0
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=6198
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends on| |6198
Referenced Issues:
https://bugs.openldap.org/show_bug.cgi?id=6198 [Issue 6198] Authorization for extensions
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Severity|normal |enhancement
https://bugs.openldap.org/show_bug.cgi?id=9211
Ryan Tandy ryan@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|ryan@openldap.org |bugs@openldap.org
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9571
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|2.6.0 |2.7.0
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.openldap.org/s | |how_bug.cgi?id=9204
https://bugs.openldap.org/show_bug.cgi?id=9211
Ondřej Kuzník ondra@mistotebe.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |DUPLICATE Status|UNCONFIRMED |RESOLVED
--- Comment #1 from Ondřej Kuzník ondra@mistotebe.net --- Once we have ACLs this becomes a choice for an admin to make.
*** This issue has been marked as a duplicate of issue 6198 ***
https://bugs.openldap.org/show_bug.cgi?id=9211
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED
-
openldap-its＠openldap.org