Mike Jackson writes: >Hallvard B Furuseth wrote: >> Note that most clients authenticate in what is normally a more secure >> and sensible way: With the Bind operation - so the server rather than >> the client will check the password. Clients which do that can't >> authenticate against such entries, since you can't tell Bind which >> password attribute to use. >> > > The userPassword attribute is multi-valued. I'm not sure about OpenLDAP, > but I do remember that Netscape/Fedora DS can bind against any of the > userPassword values. As well, mail is multi-valued. If you would use > mail as a multi-valued RDN, then given any valid RDN and any valid > userPassword, the bind should be successful.
Yes. I should have said, the original poster can't use Bind to achieve his goal with that scenario, since an account owner should not be able to authenticate with e.g. email2 + password5. > The problem here is that within one account "user A" could spoof to be > "user B", while using "user A's" password. For example, user A could say > "my username is user B, and here is my user A password". I would be > almost willing to bet that none of the users within a single account > would ever figure this out or try this. Could easily happen by accident: Someone with access to several of an account's addresses didn't remember which password went with which address. > Still, the risk does exist. > > Another way to model this type of multi-user account is to create an > object for the main account, and then create child entries for the > sub-accounts. Yup. -- Regards, Hallvard --- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
