Sean:
We have anonymous lookups and searching turned off.
Probably a good idea... ;-)
What I'm trying to do is set up a subversion repository that will
allow authentication for users in both branches. The wall I'm hitting
is that most authentication components want either anonymous lookups
to find the user in question and then authenticate, or a specific
branch to find the use in question.
I think you may be confused... typically, authentication components want
to see:
- a bind dn (who to auth to the directory to do the search as)
- a search base (where to start looking for user entries)
- a search filter (how to tell what entries to pay attention to)
and POSSIBLY:
- a password attribute
To do what you want, you simply need to move up 1 level in your search
base. This will make auth_ldap search both branches.
Is this bad directory design on my part? Should I create a dynamic
group with the particular people I want to include in this
authentication? All users in question have one particular attribute
set, so I could create the group pretty easily. I'm just trying to
figure out whether or not I'm heading in the right direction.
I don't think that your directory design is atypical. I've often
considered another level of abstraction like:
ou=accounts
ou=people
uid=whomever,...
ou=applications
uid=whatever,....
But I've never implemented it that way.. my directory looks basically
like yours.
Incidentally, I run a subversion repository which uses auth_ldap. In
order to do what you want, you probably want a AuthLDAPURL something
like mine:
AuthLDAPUrl ldap://ldap.weyco.com/dc=weyco,dc=com?uid
I typically couple this with the usage of groups to limit access to
particular subsets of people. For example, I use the following to limit
access to developer people:
require group cn=developers,ou=groups,dc=weyco,dc=com
Hope this helps...
Cheers,
Joseph Dickson
Unix Administrator - WEYCO, INC. | [EMAIL PROTECTED] | 800.748.0003 ext 1216
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
