> We have just migrated from openldap to fedora, and have realized with > horror that some authentication clients (for example CAS) are giving the > OK to users who submit un empty password string. > > We have been going slowly mad trying to find how to block this in the > configuration. FDS only cares about the bind method when evaluating access control to data. When only using the external bind interface, AFAIK there is currently no way to disable anonymous binds from succeeding with FDS. One could write a pre authentication plugin which, when enabled, would prevent anonymous binds from succeeding and send the unwilling to perform back to the client. BR, -- mike
