HI!
Lurking on the FDS list I noticed the new "Autobind" feature of FDS for LDAPI connections which directly emulates a SASL EXTERNAL bind if the client connects over LDAPI with a certain user-ID and simple bind (or no bind at all). It's configured at the server's side.
See http://directory.fedoraproject.org/wiki/LDAPI_and_AutoBind
Wouldn't that be a useful feature in OpenLDAP's slapd too for LDAP for automagically binding LDAP clients which aren't capable of sending SASL-Bind EXTERNAL but are capable to connect via LDAPI?
Ciao, Michael.
Michael Ströder wrote:
HI!
Lurking on the FDS list I noticed the new "Autobind" feature of FDS for LDAPI connections which directly emulates a SASL EXTERNAL bind if the client connects over LDAPI with a certain user-ID and simple bind (or no bind at all). It's configured at the server's side.
See http://directory.fedoraproject.org/wiki/LDAPI_and_AutoBind
Wouldn't that be a useful feature in OpenLDAP's slapd too for LDAP for automagically binding LDAP clients which aren't capable of sending SASL-Bind EXTERNAL but are capable to connect via LDAPI?
No, it's a direct violation of RFC4513 and a security hole. We had this long discussion on the fedora-devel list over a year ago.
https://www.redhat.com/archives/fedora-directory-devel/2007-February/msg0004...
This is not a feature, it's a bug, and the fact that they've gone ahead and advertised it shows just how poorly their thought processes are working.
On Sat, 2008-05-10 at 03:16 -0700, Howard Chu wrote:
Michael Ströder wrote:
HI!
Lurking on the FDS list I noticed the new "Autobind" feature of FDS for LDAPI connections which directly emulates a SASL EXTERNAL bind if the client connects over LDAPI with a certain user-ID and simple bind (or no bind at all). It's configured at the server's side.
See http://directory.fedoraproject.org/wiki/LDAPI_and_AutoBind
Wouldn't that be a useful feature in OpenLDAP's slapd too for LDAP for automagically binding LDAP clients which aren't capable of sending SASL-Bind EXTERNAL but are capable to connect via LDAPI?
No, it's a direct violation of RFC4513 and a security hole. We had this long discussion on the fedora-devel list over a year ago.
https://www.redhat.com/archives/fedora-directory-devel/2007-February/msg0004...
This is not a feature, it's a bug
Fortunately it is compiled out and configured off by default.
Andrew Bartlett
-
Andrew Bartlett -
Howard Chu -
Michael Ströder