Good afternoon.
I have a few questions about anon binds.
In theory if you have 3000 user objects in the directory and anonymous binds have a limit returning 2000 entries can you still use anonymous binds in LDAP client configurations without issues?
So you have a "resource limit" setup for "anonymous binds" which
sets the sizelimit to 2000? If that is the case then your client
will hit this "2000" entry sizelimit - if it does an anonymous
bind to the server. If it provides credentials then it will not
be restricted by the configured anonymous resource limits.
Or does something else take place when a user logs in that only requires the LDAP clients (sssd or nscld) to parse that specific user dn and attributes?
I'm not that familiar with sssd or nscld enough to say, but I'm
pretty sure they can be configured to use a specific bind dn and
password.
Typically, with OpenLDAP I have created a "bind" user that can read all user/group objects with limited attributes and turned off anon binds so I don't fully understand the behavior of anonymous binds.
In our server you can create users that have aci's that grant
them specific access as well. Anonymous access can also be
disabled in our server.
To recap what an anonymous bind is, it is when a client connects to the server but does not provide any credentials. The behavior of such connections/operations will depend on what aci's and resource limits you have configured.
I don't think this is what you are asking about though, so can
you please clarify your questions?
Thanks,
Mark
Mike
_______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
-- Directory Server Development Team
_______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
