[ ispman-Bugs-1726576 ] vhosts.acl.template and mod_authnz_ldap.c fails to auth

Bugs item #1726576, was opened at 2007-05-27 19:16
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=108390&aid=1726576&group_id=8390

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: backend
Group: None
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Andreas John (derjohn)
Assigned to: Joerg Delker (jdelker)
Summary: vhosts.acl.template and mod_authnz_ldap.c fails to auth

Initial Comment:
Hi,

I you set a protected "realm" via the Web UI -> ACLs for a host, there are two possible problems with the current vhosts.acl.template.

1.) If you have a admin user who has the same username as as the web user, the auth fails, because authnz_ldap finds two matches and denies to auth even one of them (with the current query filter in the template)

2.) There might be security-relevant cross-domain authentications possible, which should be avoided via a more specific base DN or ldap filter.

Please consider making the checks moer stict in the defaukt template, as discussed in the chat.

Rgds,
Andreas "derjohn"



----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=108390&aid=1726576&group_id=8390

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/