Kuba Nowak wrote:
Let's suppose there is an authentication module which gives
user proxy certificate (generated using certificate stored
in LDAP) as a response to valid username and password. This
proxy certificate may vary depending on the role: normal
user or admin. After successful authentication admin might
want to connect directly to LDAP server with an eye to create
new entry. The point is, to use proxy certificate as an
authorization to not force the user to use the password yet
again.
Have you got any ideas?
I would defer to Michael on the question of proxy authorization, which I
have no experience with, but you could be taking a circuitous and
potentially insecure route to overcoming a limitation of the API you use
for authentication.
If you connect and bind to a directory, there is no reason you have to
throw the connection away. It can be reused to perform any number of
directory operations with the authority of the binding user.
Jon Roberts
www.mentata.com
---
sed *is* a scripting language
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
