So, the only place I have bind defined in the Perl Backend is the one on dc=mfa, there is nothing else that can bind anywhere. I don't want anything to be able to do anything other than a straight LDAP bind to the dc=mfa branch, they don't even do a search against it, just straight connect, bind, disconnect.

The solution you gave below doesn't seem to work either, as no error code is returned.

If I could somehow get the originating IP address passed in to Perl, I could have it check that and return error code 53 or something similar, but right now, it's passing everything into Perl, regardless of the IP address, and authenticating the user.

-Etan E. Weintraub Information Security Architect IT@Johns Hopkins Johns Hopkins at Mt. Washington 5801 Smith Ave. Davis Building Suite 3110B Baltimore, MD 21209 Phone: 667-208-6309 E-mail: eweintra@jhmi.edu

-----Original Message----- From: Quanah Gibson-Mount [mailto:quanah@symas.com] Sent: Tuesday, June 6, 2017 2:37 PM To: Etan Weintraub eweintra@jhmi.edu; 'openldap-technical@openldap.org' openldap-technical@openldap.org Subject: Re: Attempting to set Access Control for auth to Perl Backend

--On Tuesday, June 06, 2017 5:32 PM +0000 Etan Weintraub eweintra@jhmi.edu wrote:

I now need to do the same type of thing for another branch, but for authentication instead (i.e. only allow auth to occur if coming from an approved IP). I've tried the following:

access to dn.sub="dc=mfa"

    by peername.ip=127.0.0.1 auth

    by peername.ip=10.181.24.193 auth

    by * none

But no luck. Any ideas/help? If I can't do this with an ACL, if I can get the IP address of the request passed in to the bind function in the Perl backend, I can handle the controls there.

That's not really what "auth" access means. Are you using simple binds? If so, I'd try something like:

access to dn.sub="dc=mfa" attrs=userPassword by peername.ip=127.0.0.1 anonymous auth by peername.ip=10.181.24.193 anonymous auth by <admin> write

access to dn.sub="dc=mfa" by users read

Now this makes some assumptions: a) Users auth against an entry in the dc=mfa tree, and b) that users only exist in that tree.

Alternatively, you may wish to look at set based ACLs to set it so that only entries that exist /in/ the dc=mfa tree can read entries in the dc=mfa tree, combined with the IP restrictions.

--Quanah

--

Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com