Michael Ströder wrote: > HI! > > I have some doubts about ACLs containing "by users" and the term > "authenticated clients" used in the man pages: If I bind with > SASL/EXTERNAL (e.g. over LDAPI) and the authc-DN does *not* map to an > authz-DN of a real directory entry what does "by users" then mean > exactly? It means anyone who has successfully authenticated, by any means. > It seems that slapd grants access with clause "by users" but I feel this > is wrong. I'd prefer if "users" would mean fully-identified clients > mapped to a real entry. No. Such a restriction would prevent distributed authentication from ever working.

--On Thursday, April 01, 2010 12:58 PM -0700 Howard Chu <hyc(a)symas.com&gt; wrote: > Michael Ströder wrote: >> HI! >> >> I have some doubts about ACLs containing "by users" and the term >> "authenticated clients" used in the man pages: If I bind with >> SASL/EXTERNAL (e.g. over LDAPI) and the authc-DN does *not* map to an >> authz-DN of a real directory entry what does "by users" then mean >> exactly? > > It means anyone who has successfully authenticated, by any means. > >> It seems that slapd grants access with clause "by users" but I feel this >> is wrong. I'd prefer if "users" would mean fully-identified clients >> mapped to a real entry. > > No. Such a restriction would prevent distributed authentication from ever > working. The downside of not being able to be able to specify authenticated DNs vs DNs that actually map to an entry in the database is that for some things (like SASL/GSSAPI setups) it makes the "users" value completely worthless, as any kerberos principal in the KDB that connects to the ldap servers is considered a "user".

Thus I had to rework all my acls to avoid ever using the "users" concept when it would have been quite useful (and had to resort to sets instead). --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra :: the leader in open source messaging and collaboration

Kurt, it's not that simple: Off course there was an successful authentication in case of SASL/EXTERNAL. Taking the term "authenticated clients" literally you're done for processing "by users". But the user is not really *identified* in terms of an entity represented by a directory entry and therefore the behaviour looks strange to me because no-one wants to deal with SASL authc-DNs when designing ACLs. I'd prefer changing semantics of "by users" to "identified clients" or having another key-word "by identifiedusers" with that semantics. The authorization step happens *after* identification based on the (optionally mapped) principal name.

IIRC, if you want all authenticated users without a directory entry to be treated as anonymous, you can perform a authzid mapping through an LDAP lookup and basically force that behavior.

Kurt Zeilenga wrote: > > On Apr 1, 2010, at 3:22 PM, Quanah Gibson-Mount wrote: > >> --On Thursday, April 01, 2010 12:58 PM -0700 Howard Chu&lt;hyc(a)symas.com&gt; wrote: >> >>> Michael Ströder wrote: >>>> HI! >>>> >>>> I have some doubts about ACLs containing "by users" and the term >>>> "authenticated clients" used in the man pages: If I bind with >>>> SASL/EXTERNAL (e.g. over LDAPI) and the authc-DN does *not* map to an >>>> authz-DN of a real directory entry what does "by users" then mean >>>> exactly? >>> >>> It means anyone who has successfully authenticated, by any means. >>> >>>> It seems that slapd grants access with clause "by users" but I feel this >>>> is wrong. I'd prefer if "users" would mean fully-identified clients >>>> mapped to a real entry. >>> >>> No. Such a restriction would prevent distributed authentication from ever >>> working. >> >> The downside of not being able to be able to specify authenticated DNs vs >> DNs that actually map to an entry in the database is that for some things >> (like SASL/GSSAPI setups) it makes the "users" value completely >> worthless, as any kerberos principal in the KDB that connects to the ldap >> servers is considered a "user". > > You confuse authentication with authorization. In this case, that > principal is certainly authenticated. It's just not authorized (in your > case). There certainly may be cases where such users are authorized to > some degree. Kurt, it's not that simple: Off course there was an successful authentication in case of SASL/EXTERNAL. Taking the term "authenticated clients" literally you're done for processing "by users". But the user is not really *identified* in terms of an entity represented by a directory entry and therefore the behaviour looks strange to me because no-one wants to deal with SASL authc-DNs when designing ACLs. I'd prefer changing semantics of "by users" to "identified clients" or having another key-word "by identifiedusers" with that semantics.

The authorization step happens *after* identification based on the (optionally mapped) principal name.