Re: [phpldapadmin] Disabled anonymous bind

Vesna,

Two points:
* PLA is like any other LDAP client - it will query the LDAP server and 
return the results it finds (authenticated or not). If you want to 
secure access to your LDAP server, then you need to configure your LDAP 
server to refuse to return information to unauthorised queries. In other 
words, securing PLA does not secure access to your LDAP server (and the 
data within).

Additionally, PLA cannot get any more information out of your LDAP 
server, than your authorisation is allowed, so while using the query URL 
directly, it will still (currently) perform the query, if it rendered 
results, it means your LDAP server is freely configured to give that 
information (to ANY LDAP client).

* That said, PLA probably should redirect to the login screen if 
anonymous bind is not enabled (as an extra level of obscurity). There is 
some work that needs to be cleaned up in the 1.2.x series (this is 
probably a good example of one), there are a couple more scenarios where 
using a URL directly (and not having some sufficient access), results in 
PLA rendering pages incorrectly.

...deon

Vesna Brljević wrote:
>
> Here is the problem. I login as an admin user and make a search query. 
> This works fine, the query returns result. I copy the link and then 
> log out. I paste the link in the browser and can see the results of 
> the search although I am not logged in. Is this expected behavior? Is 
> it possible to disable anonymous to see this result? Bellow is an 
> example of the query.
>


------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/