Michael Ströder wrote:

HI!

We a currently testing a custom OpenLDAP setup where specific modify requests are handled via back-sock (redirected via slapo-rwm) by a handler implemented in Python. These modify requests are checked and then passed to the real database backend (back-hdb) on behalf of the user bound to slapd. This works by looking at the line (binddn: ) passed to the handler by back-sock.

But now there's requirement for proxy authorization. The web application binds via SASL bind DIGEST-MD5 and explicitly sets the authzid in the SASL bind request which is mapped via authz-regexp to an authz-DN. This setup seems to work (tested with commandline-tool ldapwhoami -X authzid) but the authz-DN is not passed to the back-sock handler. binddn: still contains the bind-DN of the web application.

Is this feasible at all? If not which parts of back-sock would have to be patched to make that work?

Look at sock_print_conn() in result.c. You'll have to add appropriate flags and keywords in the config and header files as well.