Pierangelo Masarati wrote:
Dieter Kluenter wrote:
when using proxy authentication with strong bind, the attribute userPassword has to have read access, that is, auth access is not sufficient Is there any particular reason for this potential security hole?
Well, if you want to use strong auth at the proxy side, the proxy needs to be able to check the password itself, and this requires the password.
OpenLDAP's proxy is not a SASL proxy, neither my (partial) knowledge of SASL allows me to state a SASL proxy is at all possible for all mechs. If it is, adding SASL proxying capabilities to OpenLDAP proxy backends would be an interesting extension.
Given that the worthwhile SASL mechanisms are designed to resist man-in-the-middle (MITM) attacks and a proxy is essentially a MITM, I'd say it's not going to happen. The proxy needs to have as much knowledge as the main server.