From: Richard Thomas <[EMAIL PROTECTED]>
Craig L. Ching wrote:
know that LDAP schemas have provisions for users and groups, but how
do I integrate my rights system with LDAP? Is there some standard? Or
should I be building my own DIT (if I understand the concept correctly)?
Are there any examples of other software that I could look at for
reference?
You may not want to depending on your application (You could just use
the LDAP for authentication if you want). If you do however,
groupOfNames is what you'll be wanting to look at.
Yes.
From: Jeff Clowser <[EMAIL PROTECTED]>
Actually, I'd recommend putting the group->rights mapping in LDAP, so
that everything is in one place, and you can administer it all together
from one interface. Otherwise, you tend to get disconnects over time.
Yes.
1. Extend groupofuniquenames. Say, create an objectclass called
appGroup, that inherits from groupofuniquenames.
No. groupOfUniqueNames is (mostly) worthless in LDAP. Use groupOfNames.
From: "Craig L. Ching" <[EMAIL PROTECTED]>
So now, a user enters their username/password into our login system.
We bind to the LDAP server to autheniticate.
If authentication is successful, we search for the groups that the user
is a member of. We will find this information by configuration options
specified at our product's installation time. It will be specific to
each LDAP implementation we support.
Once we have the groups, we look for our new custom element and pull out
the rights from that element.
Does that sound about right?
A particular authorization check can be accomplished in one step. If you
define your custom group objectClass to include a rights attribute, e.g.
objectClass ( myGroupOID NAME 'myGroup' SUP groupOfNames MAY myRights )
and you have a group entry like
dn: cn=developers,ou=groups,dc=example,dc=com
cn: developers
objectClass: myGroup
member: cn=joe bloggs,ou=people,dc=example,dc=com
member: cn=jane doe,ou=people,dc=example,dc=com
myRights: createFiles
myRights: destroyFiles
myRights: computePi
then once the user has authenticated, you verify a particular right by
doing a search with the filter:
(&(objectClass=myGroup)(member=cn=jane
doe,ou=people,dc=example,dc=com)(myRights=createFiles))
You don't need to examine the contents of the returned entries at all.
If the search returns any entries, then you know that the particular
user belongs to at least one group with the required privilege. You only
need to examine the contents if you're trying to exhaustively display
all of the rights associated with a given user.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
