Re: LDAP Suggestion

Hi!

On Fri, Jul 19, 2002 at 12:08:42PM -0400, Jonathan Zuilkowski wrote:
> I have a suggestion that I'd like you all to take a look at.
> 
> The background is that I'm using SunOne/iPlanet/Netscape(name of the week, 
> take your pick) LDAP server with SHA1 for the passwords. This isn't 
> something that I can change.
> 
> Instead of using a BindDN and getting the password, comparing, etc., how 
> about just performing a bind operation with the login and password in 
> question? If you are able to bind with them then you've determined that 
> they are valid.

It is already implemented (in the ldap_fetch function) since
proxy-suite-1.9 -- see "man 5 ftp-proxy.conf":

       LDAPBindDN
              Defines  the  distinguished  name  that  is used to
              (simple) bind the directory service. Defaults to an
              empty  string  (anonymous  bind).  It is allowed to
              include  one  %s  in  this  string,  that  will  be
              replaced with the FTP username or authuser if User­
              AuthMagic is used.  See also UserAuthMagic, LDAPAu­
              thDN, LDAPBindPW options.

and ftp-proxy.conf.sample:

#
# Use distinguished name to (simple) bind to the directory
# service. If not set, an annonymous bind is used.
# If (exactly one) %s is used, the name will be replaced
# by the auth name while user authentication or the FTP
# user name.
#
# LDAPBindDN            uid=%s,dc=domain,dc=tld
# LDAPBindDN            uid=ftp-proxy,dc=domain,dc=tld


Kind regards,
 Marius Tomaschewski <[email protected]>
--
 SuSE Linux AG, NÃŒrnberg - SuSE Labs, Product Developement
 PGP public key available:   http://www.suse.de/~mt/mt.pgp
 Fprint:  EA 1F 92 75 1A F9 82 07  A1 28 DE 7A 32 E8 97 18

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]