From ando@sys-net.it Fri Dec  7 14:26:18 2007
From: Pierangelo Masarati <ando@sys-net.it>
To: openldap-software@openldap.org
Subject: Re: size limit by ip?
Date: Fri, 07 Dec 2007 15:24:19 +0100
Message-ID: <1159.151.24.107.21.1197037459.squirrel@151.24.107.21>
In-Reply-To: <47559C84.7060801@columbia.edu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3041783337232388550=="

--===============3041783337232388550==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

> Is it possible to control the size limit based on the ip address?
>
> man slapd.conf
>
>        *limits* <*who*> <*limit*> *[*<*limit*> *[...]]
>
> *The argument *who* can be any of
>
> 		     anonymous	  |   users   |   [dn[.<style>]=]<pattern>   |
> 		     group[/oc[/at]]=<pattern>
>
>
> Which doesn't look like the 'who' can be an ip address,
> but I just want to confirm that is the case (since the 'who' in
> slapd.access support peername.ip and I'm hoping that
> that the underlying code for both 'who's is the same :)

The man page is correct, it's not possible.

> Basically we have software running on a host that is
> unable to authenticate (due to 3rd party software)
> and we need to increase the size limits for queries coming from it,
> without increasing that limit for all anonymous binds.

Your problem sounds general enough to deserve an extension of the limits
"who" clause semantics (I don't see it quite high-priority, though).  In
any case, the modification should be trivial enough.  I suggest you file
an ITS for a feature request.

> Are there alternative ways of doing this?
> Possibly setting up a server with back-ldap running, only allowing
> access from the specific
> ip address and letting the back-ldap server bind to real servers as an
> authorized account?
>
> Or is there a way to map ip address to an identity that can be used in
> the limits control.

Using idassert-bind with back-ldap would allow to transform an anonymous
connection into an authorized one.  However, the request would then appear
as originating from the DSA instantiating the back-ldap, rather than from
the actual client.

> We're running 2.3.24.

You should definitely upgrade.

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati(a)sys-net.it
---------------------------------------



--===============3041783337232388550==--