Recently seen a few people assume that authz-regexp search-based mappings enforce that an entry is found or the Bind is failed, which is not the case. Obviously the admin guide[0] should be adjusted not to cause more confusion but the question remains:
Should we be able to decide whether an identity should be considered a "user" (Bind succeeds)?
Right now, trusting certificates issued by a CA means *all* of them will always be accepted if valid for Binding against the server. Similar with other SASL mechanisms (kerberos, ...) but those tend to have another way of setting up a policy that can be decided for a specific combination of identity+server.
It mostly matters for internal ACL purposes, those clients have passed a Bind and so are considered "users", complicating ACL design somewhat. Accepting a SASL Bind for authorisation in external clients is of less value, it can only give a yes/no answer where a more detailed answer is usually needed anyway.
It might be possible to make the search-based mappings a policy point, letting a mapping that triggered but failed to map to an entry become an indication that the bind should be denied. This would be considerable change for some deployments out there, while it might protect some that (wrongly) assumed this to be the case already. Obviously "Direct Mappings" would stay unaffected because they should be well understood already[1].
[0]. https://www.openldap.org/doc/admin26/sasl.html#Search-based%20mappings [1]. Admin guide for direct mappings already says "it allows mapping to DNs which refer to entries not held by this server" in the first paragraph
Always remember that authentication and authorization are different things. Many more entities might be able to authenticate than are authorized to take any particular action.
--On Tuesday, April 18, 2023 4:43 PM +0200 Ondřej Kuzník ondra@mistotebe.net wrote:
Recently seen a few people assume that authz-regexp search-based mappings enforce that an entry is found or the Bind is failed, which is not the case. Obviously the admin guide[0] should be adjusted not to cause more confusion but the question remains:
Should we be able to decide whether an identity should be considered a "user" (Bind succeeds)?
I'm generally of the opinion that using "by users X" other than "by users none" is a very bad idea and should be avoided, largely for the issues above. A user is anything that had some sort of success in a BIND operation, whether or not (particularly when dealing with SASL mechanisms) it actually mapped to something in the database. It's only a small step above "by anonymous X". There are valid reasons to allow a SASL bind that doesn't actually map to something in the DB.
--Quanah
-
Jordan Brown -
Ondřej Kuzník -
Quanah Gibson-Mount