On Tue, 2016-06-21 at 10:46 +0000, kashefi@xxxxxxxxxxxxxx wrote: > I have three applications that use my ldap installation to authenticate users with Bind operation. I need to restrict each app so it only be able to bind it's own users. my idea was to create a multi-value attribute for each user named "App" which has the name of the application that the user is allowed use (For instance: mail, portal and office). I'm looking for a way to restrict each application from binding users who do not have that application in their "App" attribute. for example portal application must only be able to bind users which have the attribute "App=portal". I was unable to do such thing using ACI. > Is it possible to implement such restriction? I think this is how I would do it. Lets say we have a user: dn: uid=test1,ou=People,dc=example,dc=com objectClass: top objectClass: account objectClass: simpleSecurityObject objectClass: YourCustomAppSchema userPassword: password uid: test1 application: foo dn: uid=test2,ou=People,dc=example,dc=com objectClass: top objectClass: account objectClass: simpleSecurityObject objectClass: YourCustomAppSchema userPassword: password uid: test2 application: bar Then the application foo, can have in it's user filter: (&(uid=%s)(application=foo)) To this filter, test1 will satisfy, but test2 will not. Conversely, test2 will work for application bar, but not foo. Because of the way most applications work they follow this pattern: * Anonymous bind * User filter with username to find the DN of the object ** new bind with DN of the object if found ** fail if no DN found As a result, this pattern will satisfy your requirements. Check the ldapfilter configuration directive to your applications, it's likely what you want to use. -- Sincerely, William Brown Software Engineer Red Hat, Brisbane
Attachment:
signature.asc
Description: This is a digitally signed message part
-- 389-users mailing list 389-users@xxxxxxxxxxxxxxxxxxxxxxx https://lists.fedoraproject.org/admin/lists/389-users@xxxxxxxxxxxxxxxxxxxxxxx
