Re: [phpldapadmin] Preventing deletion of attributes

On 05/10/11 18:54, Cristian Rigamonti wrote:
> I guess the right way (tm) to do this would be to use a custom LDAP schema with
> the userPassword attribute defined as MUST attribute: can you confirm that PLA
> would then deny the operation in this case?

No, PLA will not enforce must attributes - that is the LDAP server's
responsibility, and if the schema defines it as a must attribute, then
the server should deny an update that removes the value.

> Otherwise, in the short run it could be easier for me to patch PLA than to
> switch to a new LDAP schema: can you suggest if there is any feature in PLA that
> I could easily customise to add a check for an empty userPassword attribute?

If you want to stop users from accessing userPassword, then make it
"read-only" (and/or hidden)
(http://phpldapadmin.sourceforge.net/wiki/index.php/Config:appearance:readonly_attrs)

While this will configure PLA so that it wont let a user modify the
attribute - obviously users can go behind PLA (with any other LDAP
client) and do the damage...

The right (tm) way to do this, would be to deny users from accessing
this field (LDAP ACL's) and have another process that enables users to
set/change their password (using a privileged DN that users dont have
access to). (This is what I do.)

...deon

------------------------------------------------------------------------------
All the data continuously generated in your IT infrastructure contains a
definitive record of customers, application performance, security
threats, fraudulent activity and more. Splunk takes this data and makes
sense of it. Business sense. IT sense. Common sense.
http://p.sf.net/sfu/splunk-d2dcopy1
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/