> -----Original Message-----
> From: Chris Knipe [mailto:ckn...@savage.za.org] On Behalf Of Chris Knipe
> Sent: Tuesday, November 30, 2010 10:52 PM
> To: php-general@lists.php.net
> Subject: RE: [PHP] LDAP, Active Directory, and permissions
> Hi,
> > Chris,
> >
> > 1) Shouldn't the OU security permissions be set within the AD itself?
> > 2) If the above is done, then the user account that's being
> > authenticated shouldn't be able to access privileged information.
> 1) Not sure.  The permissions I'm after is similar to that of NTFS
> on the file system.  Essentially, it is a way to restrict an application
to read
> certain OU's or Objects completely, making it invisible.
> FYI... http://technet.microsoft.com/en-us/library/cc785913(WS.10).aspx

I guess you didn't read far down enough to 'User Authentication':  'Active
Directory ... to access objects...'  (Note that every OU is the same any
network resource.)  That's exactly what I mentioned.  OU security settings
is similar to NTFS, user/group with the lesser privilege applies.

> 2) This is completely irrelevant to authentication.  See point 1 above.

It's completely relevant, if you set the permissions on the OUs. (How do you
think have the access permission to the OUs?  Are a domain/enterprise admin?
Create a test a user account and an OU.  Set the security permissions.  Test
with the user account on accessing that OU and compare it to a domain admin
account.) The app that logins under a certain account would be restricted to
the set permissions.  If the users are using the PHP app then the app should
be passing the user's authentication along to AD for authentication instead
of a network service type account to login and then validate user's
authentication to see if the user is a valid.  Thus the security is
maintained/restricted to each individual login.  (Think of as network share
mapping.  You can login to a share and still change to a different user
account afterwards.)  If you try to do a work around in C# or a DLL of some
type as you mentioned earlier, you'll have to do the same thing.  So, I
strongly suggest you look into the adLDAP and modify accordingly if the app
isn't behaving as I mentioned.  Also, look into these [1] & [2].

> > Just curious, are you using phpldapadmin?
> A modified version of adLDAP, http://adldap.sourceforge.net/
> Regards,
> Chris.


[1] http://support.microsoft.com/kb/320528
[2] http://support.microsoft.com/kb/326690

PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to