Hello everyone! I have a little, let me say, "architectural doubt", and would like some ideas/suggestions from anybody!!
I have a OpenLDAP server running in a Machine 1. In a Machine 2, I have a email (postfix with sasl) and proxy (squid for Internet access) services. The initial idea is that in my LDAP server (Machine 1) I would have 2 groups: Email and Proxy, where users who have access to this services belong to the respective groups, for example, user1 has access to email and proxy services, so, he belongs to Email and Proxy groups in LDAP, and another user2 has access only to proxy, so, he belongs only to the Proxy group. Well, my doubt is, how to make the proxy and email services (running on Machine 2) interact with my LDAP server, in such a way that the proxy only authenticate users belonging to the group Proxy and the email only authenticate users belonging to the group Email ? Is this the best way? Or it would be better to forget about the groups approach and create user flags (through attributes), like proxyAllowed = "Y" or "N" and emailAllowed = "Y" or "N" ? Or even a way to use ACLs of Openldap, allowing the reading of a specific field of LDAP (for example, cn=Email,dc=domain and cn=Proxy,dc=domain) ? Well, sorry about the big mail, and I'm taking any suggestions!!!!!!! Thanks in advance. Best Steve --- You are currently subscribed to [EMAIL PROTECTED] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
