The following issue has been RESOLVED. ====================================================================== http://dbmail.org/mantis/view.php?id=289 ====================================================================== Reported By: moje Assigned To: paul ====================================================================== Project: DBMail Issue ID: 289 Category: Authentication layer Reproducibility: always Severity: block Priority: normal Status: resolved Resolution: no change required Fixed in Version: SVN Trunk ====================================================================== Date Submitted: 04-Jan-06 19:36 CET Last Modified: 24-Mar-06 12:52 CET ====================================================================== Summary: ldapauth don't allow anonymous bind Description: ldapauth default behaviour is try to bind using password and fail if unsuccessfull, but some users (for example me) don't want to provide ldap master password. My recomendation is to allow anonymous LDAP bind if password is blank. This method will disable dbmail-users, but it's not important. No one will use dbmail-users for LDAP updates (high madness level is required for administrating ldap using dbmail-users). ======================================================================
---------------------------------------------------------------------- aaron - 04-Jan-06 21:04 ---------------------------------------------------------------------- Try leaving BIND_DN and BIND_PW blank. Or create an account and call it Anonymous, with a dumb (or blank) password and no write access to anything. This is also useful because you can restrict what it has read access to, and turn off anonymous binding altogether. ---------------------------------------------------------------------- aaron - 24-Mar-06 12:52 ---------------------------------------------------------------------- I read and re-read the code, and if you leave the BIND_DN and BIND_PW blank, an anonymous connection should be made. Reopen the bug if that's not the case! I also highly recommend the silly-anon-user method, and disabling anonymous binds. Of course you should never put your master LDAP password into a config file like this; hopefully you didn't also put your root database password, but rather created a dbmail user for your database. Issue History Date Modified Username Field Change ====================================================================== 04-Jan-06 19:36 moje New Issue 04-Jan-06 21:04 aaron Note Added: 0000969 27-Jan-06 21:03 paul Status new => assigned 27-Jan-06 21:03 paul Assigned To => paul 24-Mar-06 12:52 aaron Status assigned => resolved 24-Mar-06 12:52 aaron Fixed in Version => SVN Trunk 24-Mar-06 12:52 aaron Resolution open => no change required 24-Mar-06 12:52 aaron Note Added: 0001053 ======================================================================
