On 10/19/21 1:43 PM, Michael Starling wrote:
Good afternoon.
I have a few questions about anon binds.
In theory if you have 3000 user objects in the directory and anonymous
binds have a limit returning 2000 entries can you still use anonymous
binds in LDAP client configurations without issues?
So you have a "resource limit" setup for "anonymous binds" which sets
the sizelimit to 2000? If that is the case then your client will hit
this "2000" entry sizelimit - if it does an anonymous bind to the
server. If it provides credentials then it will not be restricted by
the configured anonymous resource limits.
Or does something else take place when a user logs in that only
requires the LDAP clients (sssd or nscld) to parse that specific user
dn and attributes?
I'm not that familiar with sssd or nscld enough to say, but I'm pretty
sure they can be configured to use a specific bind dn and password.
Typically, with OpenLDAP I have created a "bind" user that can read
all user/group objects with limited attributes and turned off anon
binds so I don't fully understand the behavior of anonymous binds.
In our server you can create users that have aci's that grant them
specific access as well. Anonymous access can also be disabled in our
server.
To recap what an anonymous bind is, it is when a client connects to the
server but does not provide any credentials. The behavior of such
connections/operations will depend on what aci's and resource limits you
have configured.
I don't think this is what you are asking about though, so can you
please clarify your questions?
Thanks,
Mark
Mike
_______________________________________________
389-users mailing list [email protected]
To unsubscribe send an email [email protected]
Fedora Code of
Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
List
Archives:https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam on the list, report
it:https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
_______________________________________________
389-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
