Hallvard B Furuseth wrote: > > Note that most clients authenticate in what is normally a more secure > and sensible way: With the Bind operation - so the server rather than > the client will check the password. Clients which do that can't > authenticate against such entries, since you can't tell Bind which > password attribute to use. >
The userPassword attribute is multi-valued. I'm not sure about OpenLDAP, but I do remember that Netscape/Fedora DS can bind against any of the userPassword values. As well, mail is multi-valued. If you would use mail as a multi-valued RDN, then given any valid RDN and any valid userPassword, the bind should be successful. The problem here is that within one account "user A" could spoof to be "user B", while using "user A's" password. For example, user A could say "my username is user B, and here is my user A password". I would be almost willing to bet that none of the users within a single account would ever figure this out or try this. Still, the risk does exist. Another way to model this type of multi-user account is to create an object for the main account, and then create child entries for the sub-accounts. I typically don't like to leaf under other than ou's as a matter of style, but this would be the exception. Mike -- http://www.netauth.com - LDAP Directory Consulting
smime.p7s
Description: S/MIME Cryptographic Signature
--- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
