View or filter based on ldaps://FQDN

List overview All Threads
Download

newer

older

what is the pretty function and...

Password Policy pwdFailureTime...

Ronie Gilberto Henrich

13 Jan 2012 13 Jan '12

3:10 p.m.

Hello,

I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. Let say I have the following in my ldap server: ou=domain ou=raincoatcompany.com ou=umbrellacompany.com

Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 So, querying the ldap server using ldaps://ldap.raincoatcompany.com/ou=domain should grant access only to the following: ou=domain ou=raincoatcompany.com

Is there any way to accomplish that with OpenLDAP?

Thanks,

-- *Ronie Henrich* *GIT - Sistemas Ltda* http://www.git.com.br Novo Hamburgo, RS Brazil http://maps.google.com/maps?q=%2CNovo+Hamburgo%2CRS%2CBrazil&hl=en *http://br.linkedin.com/in/roniegh* See who we know in common http://www.linkedin.com/e/wwk/11684020/

Show replies by date

Howard Chu

14 Jan 14 Jan

3:45 a.m.

Ronie Gilberto Henrich wrote:

...

Hello,

I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. Let say I have the following in my ldap server: ou=domain ou=raincoatcompany.com ou=umbrellacompany.com

Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 So, querying the ldap server using ldaps://ldap.raincoatcompany.com/ou=domain should grant access only to the following: ou=domain ou=raincoatcompany.com

Is there any way to accomplish that with OpenLDAP?

Not possible. slapd only sees the IP address of the incoming connection, it has no way to know what DNS name was used to resolve to that address.

-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

Erwann Abalea

4:23 a.m.

Can't SNI support be added?

-- Erwann. Le 14 janv. 2012 13:08, "Howard Chu" hyc@symas.com a écrit : > > Ronie Gilberto Henrich wrote: >> >> Hello, >> >> I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. >> Let say I have the following in my ldap server: >> ou=domain >> ou=raincoatcompany.com >> ou=umbrellacompany.com >> >> Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 >> So, querying the ldap server using ldaps:// ldap.raincoatcompany.com/ou=domain should grant access only to the following: >> ou=domain >> ou=raincoatcompany.com >> Is there any way to accomplish that with OpenLDAP? > > Not possible. slapd only sees the IP address of the incoming connection, it has no way to know what DNS name was used to resolve to that address.

Howard Chu

4:35 a.m.

Erwann Abalea wrote:

...

Can't SNI support be added?

Perhaps. It depends on which version of TLS library is being used.

...

-- Erwann.

Le 14 janv. 2012 13:08, "Howard Chu" <hyc@symas.com mailto:hyc@symas.com> a écrit :

...
Ronie Gilberto Henrich wrote:

...
Hello,

I need to be able to restrict ldap ou's access based on the ldaps://FQDN

used to query the ldap server.

...
...
Let say I have the following in my ldap server: ou=domain ou=raincoatcompany.com http://raincoatcompany.com ou=umbrellacompany.com http://umbrellacompany.com

Considering that both ldap.raincoatcompany.com

http://ldap.raincoatcompany.com and ldap.umbrellacompany.com http://ldap.umbrellacompany.com are resolving to IP address 10.0.0.10

...
...
So, querying the ldap server using

ldaps://ldap.raincoatcompany.com/ou=domain http://ldap.raincoatcompany.com/ou=domain should grant access only to the following:

...
...
ou=domain ou=raincoatcompany.com http://raincoatcompany.com Is there any way to accomplish that with OpenLDAP?

Not possible. slapd only sees the IP address of the incoming connection, it

has no way to know what DNS name was used to resolve to that address.

-- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

Erwann Abalea

4:46 a.m.

A quick addition: SNI was defined to solve a problem not encountered with LDAP (name virtual hosting on a unique IP address). It also requires the client to be cooperative and announce the desired hostname in an extension (Server Name Indication) during TLS negotiation. Not supporting it in an LDAP context is not bad, or a lack of anything.

My opinion would be that the OP redefines his need.

-- Erwann. Le 14 janv. 2012 13:23, "Erwann Abalea" eabalea@gmail.com a écrit : > > Can't SNI support be added? > > -- > Erwann. > > Le 14 janv. 2012 13:08, "Howard Chu" hyc@symas.com a écrit : > > > > > Ronie Gilberto Henrich wrote: > >> > >> Hello, > >> > >> I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. > >> Let say I have the following in my ldap server: > >> ou=domain > >> ou=raincoatcompany.com > >> ou=umbrellacompany.com > >> > >> Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 > >> So, querying the ldap server using ldaps:// ldap.raincoatcompany.com/ou=domain should grant access only to the following: > >> ou=domain > >> ou=raincoatcompany.com > >> Is there any way to accomplish that with OpenLDAP? > > > > Not possible. slapd only sees the IP address of the incoming connection, it has no way to know what DNS name was used to resolve to that address.

Ronie Gilberto Henrich

6:59 a.m.

Howard Chu wrote:

...

Ronie Gilberto Henrich wrote:

...
Hello,

I need to be able to restrict ldap ou's access based on the ldaps://FQDN used to query the ldap server. Let say I have the following in my ldap server: ou=domain ou=raincoatcompany.com ou=umbrellacompany.com

Considering that both ldap.raincoatcompany.com and ldap.umbrellacompany.com are resolving to IP address 10.0.0.10 So, querying the ldap server using ldaps://ldap.raincoatcompany.com/ou=domain should grant access only to the following: ou=domain ou=raincoatcompany.com

Is there any way to accomplish that with OpenLDAP?

Not possible. slapd only sees the IP address of the incoming connection, it has no way to know what DNS name was used to resolve to that address.

Is it possible to allow access to a specific dn only by a specific client IP address? ie: access to dn.exact="ou=domain,ou=raincoatcompany.com" by clientIP=200.200.0.117 read

masarati＠aero.polimi.it

7:15 a.m.

...

Is it possible to allow access to a specific dn only by a specific client IP address? ie: access to dn.exact="ou=domain,ou=raincoatcompany.com" by clientIP=200.200.0.117 read

Yes. See "peername" <who> clause in slapd.access(5).

Michael Ströder

7:28 a.m.

Ronie Gilberto Henrich wrote:

...

Is it possible to allow access to a specific dn only by a specific client IP address? ie: access to dn.exact="ou=domain,ou=raincoatcompany.com" by clientIP=200.200.0.117 read

See the man page slapd.access(5), especially

peername[.<peernamestyle>]=<peername>.

More ideas for access control here (not for IP-based authentication though):

http://www.openldap.org/faq/data/cache/189.html

Ciao, Michael.

4734

Age (days ago)

4735

Last active (days ago)

openldap-technical@openldap.org

7 comments

5 participants

tags (0)

participants (5)

Erwann Abalea
Howard Chu
masarati＠aero.polimi.it
Michael Ströder
Ronie Gilberto Henrich