nss_ldap without nscd or cached ?

2007-05-24 Thread Mohacsi Janos
Dear All, I think there is a some architectural issues with the current implementation of nsswitch or nsdispatch(3). Let's assume you want to authenticate against an LDAP database. You will install nss_ldap from port. You configure nss_ldap.conf with binddn and its bindpw. Here comes the

Re: nss_ldap without nscd or cached ?

2007-05-24 Thread Michael Bushkov
Hello Mohacsi, Dear All, I think there is a some architectural issues with the current implementation of nsswitch or nsdispatch(3). Let's assume you want to authenticate against an LDAP database. You will install nss_ldap from port. You configure nss_ldap.conf with binddn and its bindpw.

Re: nss_ldap without nscd or cached ?

2007-05-24 Thread Dan Nelson
In the last episode (May 24), Mohacsi Janos said: I think there is a some architectural issues with the current implementation of nsswitch or nsdispatch(3). Let's assume you want to authenticate against an LDAP database. You will install nss_ldap from port. You configure nss_ldap.conf

Re: nss_ldap without nscd or cached ?

2007-05-24 Thread Mohacsi Janos
Hi Michael, On Thu, 24 May 2007, Michael Bushkov wrote: Hello Mohacsi, Other solution(?) would be to limit binddn access to read-only (also limiting access only few attributes in LDAP) then exposing the bindpw would not create big problem. However maintenance of LDAP ACI-s could be