https://bugs.openldap.org/show_bug.cgi?id=6598
--- Comment #20 from Mehmet gelisin <[email protected]> --- If non-anonymous access is needed, the slapd.access(5) manpage needs an > update too. (Or instead, to avoid duplicating text.) Currently it just > says: http://www-look-4.com/ > > Auth (=x) privileges are also required on the authzTo attribute > of the authorizing identity and/or on the authzFrom attribute of > the authorized identity. http://www.compilatori.com/ > > but it doesn't mention to who needs that auth access. It http://www.wearelondonmade.com/ is the authenticated ID that needs access in both cases. On further thought I think it is correct that the access is checked without reference to whether that ID has access to entry and parent entries, as (particularly in the case of authzFrom) http://www.jopspeech.com/ the authenticated ID may not have any direct access to the entry whose ID it is about to assume. http://joerg.li/ Thus, if principal A has authenticated and wishes to perform an operation using principal B's authorisation, the access required is: A needs auth access to authzTo in its own entry if that attribute is involved in giving A permission to act for B. http://connstr.net/ A needs auth access to authzFrom in B's entry if that attribute is involved in giving A permission to act for B. The rules are the same whether using a SASL authorization identity or using a ProxyAuth control on an LDAP operation. http://embermanchester.uk/ Thus I think my original report was wrong. This is a documentation issue, not a bug. If non-anonymous access is needed, the slapd.access(5) manpage needs an http://www.slipstone.co.uk/ > update too. (Or instead, to avoid duplicating text.) Currently it just > says: > > Auth (=x) privileges are also required on the authzTo attribute > http://www.logoarts.co.uk/ > of the authorizing identity and/or on the authzFrom attribute of > the authorized identity. > > but it doesn't mention to who needs that auth access. http://www.acpirateradio.co.uk/ It is the authenticated ID that needs access in both cases. On further thought I think it is correct that the access is checked without reference to whether that ID has access to entry and parent entries, as (particularly in the case of authzFrom) the https://waytowhatsnext.com/ authenticated ID may not have any direct access to the entry whose ID it is about to assume. Thus, if principal A has authenticated and wishes to perform an https://www.webb-dev.co.uk/ operation using principal B's authorisation, the access required is: A needs auth access to authzTo in its own entry if that attribute is involved in giving A permission to act for B. A needs auth access to authzFrom in B's entry if that attribute is involved in giving A permission to act for B. The rules are the same whether using a SASL authorization identity or using a ProxyAuth control on an LDAP operation. http://www.iu-bloomington.com/ Thus I think my original report was wrong. This is a documentation issue, not a bug. -- You are receiving this mail because: You are on the CC list for the issue.
