mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-21 03:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

Rework intro and sasl a bit.

Browse Source 
Add TLS.sdf (needs to be written)
Reorder chapter
This commit is contained in:
Kurt Zeilenga 2001-05-12 06:15:42 +00:00
parent 74fa239a20
commit 977cee7ffd
4 changed files with 274 additions and 226 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

393
doc/guide/admin/intro.sdf
View File

@ -8,81 +8,85 @@ software to provide directory services. This includes details on
how to configure and run the stand-alone {{TERM:LDAP}} daemon,
{{slapd}}(8) and the stand-alone LDAP update replication daemon,
{{slurpd}}(8). It is intended for newcomers and experienced
administrators alike. This section provides a basic introduction to
directory services and, in particular, the directory services provided
by {{slapd}}(8).
administrators alike. This section provides a basic introduction
to directory services and, in particular, the directory services
provided by {{slapd}}(8).
H2: What is a directory service?
A directory is specialized database optimized for reading, browsing and
searching. Directories tend to contain descriptive, attribute-based
information and support sophisticated filtering capabilities. Directories
generally do not support complicated transaction or roll-back schemes
found in database management systems designed for handling high-volume
complex updates. Directory updates are typically simple all-or-nothing
changes, if they are allowed at all. Directories are tuned to give
quick-response to high-volume lookup or search operations. They may have
the ability to replicate information widely in order to increase
availability and reliability, while reducing response time. When
directory information is replicated, temporary inconsistencies between
the replicas may be okay, as long as they get in sync eventually.
A directory is specialized database optimized for reading, browsing
and searching. Directories tend to contain descriptive, attribute-based
information and support sophisticated filtering capabilities.
Directories generally do not support complicated transaction or
roll-back schemes found in database management systems designed
for handling high-volume complex updates. Directory updates are
typically simple all-or-nothing changes, if they are allowed at
all. Directories are tuned to give quick-response to high-volume
lookup or search operations. They may have the ability to replicate
information widely in order to increase availability and reliability,
while reducing response time. When directory information is
replicated, temporary inconsistencies between the replicas may be
okay, as long as they get in sync eventually.
There are many different ways to provide a directory service. Different
methods allow different kinds of information to be stored in the directory,
place different requirements on how that information can be referenced,
queried and updated, how it is protected from unauthorized access, etc.
Some directory services are {{local}}, providing service to a restricted
context (e.g., the finger service on a single machine). Other services are
global, providing service to a much broader context (e.g., the entire Internet).
Global services are usually {{distributed}}, meaning that the data they
contain is spread across many machines, all of which cooperate to provide
the directory service. Typically a global service defines a uniform
{{namespace}} which gives the same view of the data no matter where
you are in relation to the data itself. The Internet {{TERM[expand]DNS}}
is an example of a globally distributed directory service.
There are many different ways to provide a directory service.
Different methods allow different kinds of information to be stored
in the directory, place different requirements on how that information
can be referenced, queried and updated, how it is protected from
unauthorized access, etc. Some directory services are {{local}},
providing service to a restricted context (e.g., the finger service
on a single machine). Other services are global, providing service
to a much broader context (e.g., the entire Internet). Global
services are usually {{distributed}}, meaning that the data they
contain is spread across many machines, all of which cooperate to
provide the directory service. Typically a global service defines
a uniform {{namespace}} which gives the same view of the data no
matter where you are in relation to the data itself. The Internet
{{TERM[expand]DNS}} is an example of a globally distributed directory
service.
H2: What is LDAP?
{{slapd}}'s model for directory service is based on a global directory
model called {{TERM:LDAP}}. LDAP stands for {{TERM[expand]LDAP}}.
LDAP is a directory access protocol that runs over
{{TERM:TCP}}/{{TERM:IP}}. The nitty-gritty details of LDAP are defined in
{{TERM:LDAP}} stands for {{TERM[expand]LDAP}}. As the name suggests,
it is a lightweight protocol for accessing directory services,
specifically {{TERM:X.500}}-based directory services. LDAP runs
over {{TERM:TCP}}/{{TERM:IP}} or other connection oriented transfer
services. The nitty-gritty details of LDAP are defined in
{{REF:RFC2251}} "The Lightweight Directory Access Protocol (v3)."
This section gives an overview of LDAP from a user's perspective.
{{What kind of information can be stored in the directory?}}
The LDAP information model is based on {{entries}}. An entry is a
collection of attributes that has a globally-unique
{{TERM[expand]DN}} (DN).
The DN is used to refer to the entry unambiguously. Each of the
entry's attributes has a {{type}} and one or more {{values}}.
The types are typically mnemonic strings, like "{{EX:cn}}" for common
name, or "{{EX:mail}}" for email address. The syntax of values depend
on the attribute type is. For example, {{EX:cn}} attribute might
be the value {{EX:Babs Jensen}}. A {{EX:mail}} attribute might
contain the value "{{EX:babs@example.com}}". A {{EX:jpegPhoto}}
attribute would contain a photograph in the JPEG (binary) format.
{{What kind of information can be stored in the directory?}} The
LDAP information model is based on {{entries}}. An entry is a
collection of attributes that has a globally-unique {{TERM[expand]DN}}
(DN). The DN is used to refer to the entry unambiguously. Each of
the entry's attributes has a {{type}} and one or more {{values}}.
The types are typically mnemonic strings, like "{{EX:cn}}" for
common name, or "{{EX:mail}}" for email address. The syntax of
values depend on the attribute type is. For example, {{EX:cn}}
attribute might be the value {{EX:Babs Jensen}}. A {{EX:mail}}
attribute might contain the value "{{EX:babs@example.com}}". A
{{EX:jpegPhoto}} attribute would contain a photograph in the JPEG
(binary) format.
{{How is the information arranged?}}
In LDAP, directory entries are arranged in a hierarchical tree-like
structure. Traditionally, this structure reflected the geographic
and/or organizational boundaries. Entries representing countries
appeared at the top of the tree. Below them are entries representing
states and national organizations. Below them might be entries
representing organizational units, people, printers, documents,
or just about anything else you can think of. Figure 1.1 shows an
example LDAP directory tree using traditional naming.
{{How is the information arranged?}} In LDAP, directory entries
are arranged in a hierarchical tree-like structure. Traditionally,
this structure reflected the geographic and/or organizational
boundaries. Entries representing countries appeared at the top of
the tree. Below them are entries representing states and national
organizations. Below them might be entries representing organizational
units, people, printers, documents, or just about anything else
you can think of. Figure 1.1 shows an example LDAP directory tree
using traditional naming.
!import "intro_tree.gif"; align="center"; \
title="LDAP directory tree (traditional naming)"
FT[align="Center"] Figure 1.1: LDAP directory tree (traditional naming)
The tree may also be arranged based upon Internet domain names. This
naming approach is becoming increasing popular as it allows for
directory services to be locating using the {{TERM[expand]DNS}}.
The tree may also be arranged based upon Internet domain names.
This naming approach is becoming increasing popular as it allows
for directory services to be locating using the {{TERM[expand]DNS}}.
Figure 1.2 shows an example LDAP directory tree using domain-based
naming.
@ -91,122 +95,181 @@ naming.
FT[align="Center"] Figure 1.2: LDAP directory tree (Internet naming)
In addition, LDAP allows you to control which attributes are required
and allowed in an entry through the use of a special attribute called
{{EX:objectClass}}. The values of the {{EX:objectClass}} attribute
determine the {{schema}} rules the entry must obey.
and allowed in an entry through the use of a special attribute
called {{EX:objectClass}}. The values of the {{EX:objectClass}}
attribute determine the {{schema}} rules the entry must obey.
{{How is the information referenced?}}
An entry is referenced by its distinguished name, which is constructed
by taking the name of the entry itself (called the {{TERM[expand]RDN}}
or RDN) and concatenating the names of its ancestor entries. For
example, the entry for Barbara Jensen in the Internet naming example
above has an RDN of {{EX:uid=babs}} and a DN of
{{EX:uid=babs,ou=People,dc=example,dc=com}}". The full DN format is
described in {{REF:RFC2253}}, "Lightweight Directory Access Protocol (v3):
UTF-8 String Representation of Distinguished Names."
{{How is the information referenced?}} An entry is referenced by
its distinguished name, which is constructed by taking the name of
the entry itself (called the {{TERM[expand]RDN}} or RDN) and
concatenating the names of its ancestor entries. For example, the
entry for Barbara Jensen in the Internet naming example above has
an RDN of {{EX:uid=babs}} and a DN of
{{EX:uid=babs,ou=People,dc=example,dc=com}}". The full DN format
is described in {{REF:RFC2253}}, "Lightweight Directory Access
Protocol (v3): UTF-8 String Representation of Distinguished Names."
{{How is the information accessed?}}
LDAP defines operations for interrogating and updating the directory.
Operations are provided for adding and deleting
an entry from the directory, changing an existing entry, and changing the
name of an entry. Most of the time, though, LDAP is used to search for
information in the directory. The LDAP search operation allows some portion
of the directory to be searched for entries that match some criteria specified
by a search filter. Information can be requested from each entry that matches
the criteria.
{{How is the information accessed?}} LDAP defines operations for
interrogating and updating the directory. Operations are provided
for adding and deleting an entry from the directory, changing an
existing entry, and changing the name of an entry. Most of the
time, though, LDAP is used to search for information in the directory.
The LDAP search operation allows some portion of the directory to
be searched for entries that match some criteria specified by a
search filter. Information can be requested from each entry that
matches the criteria.
For example, you might want to search the entire directory subtree at
and below {{EX:dc=example,dc=com}} for people with the name {{EX:Barbara
Jensen}}, retrieving the email address of each entry found. LDAP lets
you do this easily. Or you might want to search the entries directly
below the {{EX:st=California,c=US}} entry for organizations with the
string {{EX:Acme}} in their name, and that have a fax number. LDAP lets
you do this too. The next section describes in more detail what you can
do with LDAP and how it might be useful to you.
For example, you might want to search the entire directory subtree
at and below {{EX:dc=example,dc=com}} for people with the name
{{EX:Barbara Jensen}}, retrieving the email address of each entry
found. LDAP lets you do this easily. Or you might want to search
the entries directly below the {{EX:st=California,c=US}} entry for
organizations with the string {{EX:Acme}} in their name, and that
have a fax number. LDAP lets you do this too. The next section
describes in more detail what you can do with LDAP and how it might
be useful to you.
{{How is the information protected from unauthorized access?}}
Some directory services provide no protection, allowing anyone to see
{{How is the information protected from unauthorized access?}} Some
directory services provide no protection, allowing anyone to see
the information. LDAP provides a mechanisms for a client to
authenticate, or prove its identity to a directory server, paving
the way for rich access control to protect the information the server
contains. LDAP also supports privacy and integrity security
the way for rich access control to protect the information the
server contains. LDAP also supports privacy and integrity security
services.
H2: How does LDAP work?
LDAP directory service is based on a {{client-server}} model. One or more
LDAP servers contain the data making up the LDAP directory tree. An LDAP
client connects to an LDAP server and asks it a question. The server
responds with the answer and/or with a pointer to where the client can
get additional information (typically, another LDAP server). No matter
which LDAP server a client connects to, it sees the same view of the
directory; a name presented to one LDAP server references the same
entry it would at another LDAP server. This is an important feature of
a global directory service, like LDAP.
LDAP directory service is based on a {{client-server}} model. One
or more LDAP servers contain the data making up the directory
information tree (DIT). The client connects to servers and
asks it a question. The server responds with an answer and/or
with a pointer to where the client can get additional information
(typically, another LDAP server). No matter which LDAP server a
client connects to, it sees the same view of the directory; a name
presented to one LDAP server references the same entry it would at
another LDAP server. This is an important feature of a global
directory service, like LDAP.
H2: What about X.500?
Technically, {{TERM:LDAP}} is a directory access protocol to an
{{TERM:X.500}} directory service, the {{TERM:OSI}} directory service.
Initially, LDAP clients accessed gateways to directory service.
This gateway ran LDAP (between the client and gateway) and X.500's
{{TERM[expand]DAP}} ({{TERM:DAP}}) (between the gateway and the
X.500 server. DAP is a heavyweight protocol that operates over a
full OSI protocol stack and requires a significant amount of
computing resources. LDAP is designed to operate over
{{TERM:TCP}}/{{TERM:IP}} and provides most of the functionality of
DAP at a much lower cost.
While LDAP is still used to access X.500 directory service via
gateways, LDAP is now more commonly directly implemented in X.500
servers.
The stand-alone LDAP daemon, or {{slapd}}(8), can be viewed as a
{{lightweight}} X.500 directory server. That is, it does not
implement the X.500's DAP. As a {{lightweight directory}} server,
{{slapd}}(8) implements only a subset of the X.500 models.
If you are already running a X.500 DAP service and you want to
continue to do so, you can probably stop reading this guide. This
guide is all about running LDAP via {{slapd}}(8), without running
X.500 DAP. If you are not running X.500 DAP, want to stop running
X.500 DAP, or have no immediate plans to run X.500 DAP, read on.
It is possible to replicate data from an LDAP directory server to
a X.500 DAP {{TERM:DSA}}. This requires an LDAP/DAP gateway.
OpenLDAP does not provide such a gateway, but our replication daemon
can be used to replicate to such a gateway. See the {{SECT:Replication
with slurpd}} chapter of this document for information regarding
replication.
H2: What the difference between LDAPv2 and LDAPv3?
There are two versions of LDAP in use today on the Internet.
LDAPv3 was developed in late 1990's to replace LDAPv2. LDAPv3
adds the following features to LDAP:
- Strong Authentication via {{TERM:SASL}}
- Integrity and Confidential Protections via {{TERM:TLS}} (SSL)
- Internationalization through the use of Unicode
- Referrals and Continuations
- Extensibility (controls and extended operations)
- Schema Discovery
Supporting both LDAPv2 and LDAPv3 simultaneously can be problematic
and generally should be avoided. As LDAPv3 is more consistenly
implemented and supports all the features of LDAPv2, use of LDAPv3
is highly recommended.
H2: What is slapd and what can it do?
{{slapd}} is an LDAP directory server that runs on many different
platforms. You can use it to provide a directory service of your very own.
Your directory can contain pretty much anything you want to put in it. You
can connect it to the global LDAP directory service, or run a service all by
yourself. Some of slapd's more interesting features and capabilities include:
{{slapd}}(8) is an LDAP directory server that runs on many different
platforms. You can use it to provide a directory service of your
very own. Your directory can contain pretty much anything you want
to put in it. You can connect it to the global LDAP directory
service, or run a service all by yourself. Some of slapd's more
interesting features and capabilities include:
{{B:LDAPv2}} and {{B:LDAPv3}}: {{slapd}} supports both version 2 and 3
of the {{TERM[expand]LDAP}}. {{slapd}} provides support
for the latest features while maintaining interoperability with
existing clients. {{slapd}} supports both IPv4 and IPv6.
{{B:LDAPv3}}: {{slapd}} implements version 3 of {{TERM[expand]LDAP}}.
{{slapd}} supports LDAP over both IPv4 and IPv6.
{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports
strong authentication services through the use of SASL. {{slapd}}'s
SASL implementation utilizes {{PRD:Cyrus}} {{PRD:SASL}} software
which supports a number of mechanisms including
DIGEST-MD5, EXTERNAL, and GSSAPI.
{{B:{{TERM[expand]SASL}}}}: {{slapd}} supports strong authentication
services through the use of SASL. {{slapd}}'s SASL implementation
utilizes {{PRD:Cyrus}} {{PRD:SASL}} software which supports a number
of mechanisms including DIGEST-MD5, EXTERNAL, and GSSAPI.
{{B:{{TERM[expand]TLS}}}}: {{slapd}} provides privacy and
integrity protections through the use of TLS (or SSL). {{slapd}}'s
TLS implementation utilizes {{PRD:OpenSSL}} software.
{{B:{{TERM[expand]TLS}}}}: {{slapd}} provides privacy and integrity
protections through the use of TLS (or SSL). {{slapd}}'s TLS
implementation utilizes {{PRD:OpenSSL}} software.
{{B:Topology control}}: {{slapd}} allows one to restrict access to
the server based upon network topology. This feature utilizes
{{TCP wrappers}}.
{{B:Access control}}: {{slapd}} provides a rich and powerful access
control facility, allowing you to control access to the information
in your database(s). You can control access to entries based on
LDAP authorization information, {{TERM:IP}} address, domain name
and other criteria.
{{slapd}} supports both {{static}} and {{dynamic}} access control
information.
and other criteria. {{slapd}} supports both {{static}} and
{{dynamic}} access control information.
{{B:Internationalization}}: {{slapd}} supports Unicode and language
tags.
{{B:Choice of databases}}: {{slapd}} comes with a variety of different
backend databases you can choose from. They include
{{B:Choice of databases}}: {{slapd}} comes with a variety of
different backend databases you can choose from. They include
{{TERM:LDBM}}, a high-performance disk-based embedded database;
SHELL, a database interface to arbitrary shell scripts; and
PASSWD, a simple password file database. LDBM utilizes either
{{PRD:BerkeleyDB}} or {{PRD:GDBM}}.
SHELL, a database interface to arbitrary shell scripts; and PASSWD,
a simple password file database. LDBM utilizes either {{PRD:BerkeleyDB}}
or {{PRD:GDBM}}.
{{B:Multiple database instances}}: {{slapd}} can be configured to serve
multiple databases at the same time. This means that a single {{slapd}}
server can respond to requests for many logically different portions
of the LDAP tree, using the same or different backend databases.
{{B:Multiple database instances}}: {{slapd}} can be configured to
serve multiple databases at the same time. This means that a single
{{slapd}} server can respond to requests for many logically different
portions of the LDAP tree, using the same or different backend
databases.
{{B:Generic modules API}}: If you require even more customization,
{{slapd}} lets you write your own modules easily. {{slapd}}
consists of two distinct parts: a front end that handles protocol
communication with LDAP clients; and modules which handle specific
tasks such as database operations. Because these two pieces communicate
via a well-defined {{TERM:C}} {{TERM:API}}, you can write your own
customized modules
which extend {{slapd}} in numerous ways. Also, a number of
{{programmable database}} modules are provided. These allow you
to expose external data sources to {{slapd}} using popular programming
languages ({{PRD:Perl}}, {{Shell}}, {{PRD:SQL}}, and {{PRD:TCL}}).
{{slapd}} lets you write your own modules easily. {{slapd}} consists
of two distinct parts: a front end that handles protocol communication
with LDAP clients; and modules which handle specific tasks such as
database operations. Because these two pieces communicate via a
well-defined {{TERM:C}} {{TERM:API}}, you can write your own
customized modules which extend {{slapd}} in numerous ways. Also,
a number of {{programmable database}} modules are provided. These
allow you to expose external data sources to {{slapd}} using popular
programming languages ({{PRD:Perl}}, {{Shell}}, {{PRD:SQL}}, and
{{PRD:TCL}}).
{{B:Threads}}: {{slapd}} is threaded for high performance. A
single multi-threaded {{slapd}} process handles all incoming
requests, reducing the amount of system overhead required.
{{B:Threads}}: {{slapd}} is threaded for high performance. A single
multi-threaded {{slapd}} process handles all incoming requests,
reducing the amount of system overhead required.
{{B:Replication}}: {{slapd}} can be configured to maintain replica
copies of its database. This {{single-master/multiple-slave}}
@ -222,50 +285,20 @@ reasonable defaults, making your job much easier.
{{slapd}} also has its limitations, of course. The main LDBM
database backend does not handle range queries or negation queries
very well. These features and more will be coming in a future release.
H2: What about X.500?
Technically, LDAP is a directory access protocol to an {{TERM:X.500}}
directory service, the {{TERM:OSI}} directory service. Initial
LDAP servers were gateways between LDAP and the X.500 {{TERM[expand]DAP}}
({{TERM:DAP}}). DAP is a heavyweight protocol that operates over a full
OSI protocol stack and requires a significant amount of computing
resources. LDAP is designed to operate over {{TERM:TCP}}/{{TERM:IP}}
and provides most of the functionality of DAP at a much lower cost.
This use of LDAP makes it easy to access the X.500 directory, but still
requires a full X.500 service to make data available to the many LDAP
clients being developed. As with full X.500 DAP clients, a full X.500
DAP server is no small piece of software to operate.
The stand-alone LDAP daemon, or {{slapd}}(8), is meant to remove much
of the burden from the server side just as LDAP itself removed much of
the burden from clients. If you are already running a X.500 DAP service
and you want to continue to do so, you can probably stop reading this
guide, which is all about running LDAP via {{slapd}}, without running
X.500 DAP. If you are not running X.500 DAP, want to stop running
X.500 DAP, or have no immediate plans to run X.500 DAP, read on.
It is possible to replicate data from an LDAP directory
server to a X.500 DAP {{TERM:DSA}}. This requires an LDAP/DAP
gateway. OpenLDAP does not provide such a gateway, but our
replication daemon can be used to replicate to such a gateway.
See the {{SECT:Replication with slurpd}} chapter of this document
for information regarding replication.
very well. These features and more will be coming in a future
release.
H2: What is slurpd and what can it do?
{{slurpd}}(8) is a daemon that helps {{slapd}} provide
replicated service. It is responsible for distributing changes made
to the master {{slapd}} database out to the various {{slapd}}
replicas. It frees {{slapd}} from having to worry that some
replicas might be down or unreachable when a change comes through;
{{slurpd}} handles retrying failed requests automatically.
{{slapd}} and {{slurpd}} communicate through a simple text
file that is used to log changes.
{{slurpd}}(8) is a daemon that helps {{slapd}} provide replicated
service. It is responsible for distributing changes made to the
master {{slapd}} database out to the various {{slapd}} replicas.
It frees {{slapd}} from having to worry that some replicas might
be down or unreachable when a change comes through; {{slurpd}}
handles retrying failed requests automatically. {{slapd}} and
{{slurpd}} communicate through a simple text file that is used to
log changes.
See the {{SECT:Replication with slurpd}} chapter for information
about how to configure and run {{slurpd}}(8).

9
doc/guide/admin/master.sdf
View File

@ -51,6 +51,12 @@ PB:
!include "schema.sdf"; chapter
PB:
!include "sasl.sdf"; chapter
PB:
!include "tls.sdf"; chapter
PB:
#!include "tuning.sdf"; chapter
#PB:
@ -60,9 +66,6 @@ PB:
!include "replication.sdf"; chapter
PB:
!include "sasl.sdf"; chapter
PB:
# Appendices
!include "../release/autoconf.sdf"; appendix
PB:

72
doc/guide/admin/sasl.sdf
View File

@ -3,21 +3,22 @@
H1: Using SASL
This chapter details how to make use of SASL to provide authentication.
OpenLDAP clients and servers are capable of providing authentication
via the {{TERM[expand]SASL}} ({{TERM:SASL}}) system, which is
explained in {{REF:RFC2222}}. There are several industry standard
authentication mechanisms that can be used with SASL, including
Kerberos V4, GSSAPI, and some of the Digest mechanisms. The standard
client tools provided with OpenLDAP, such as {{ldapsearch}}(1) and
{{ldapmodify}}(1), will by default attempt to authenticate the user
to the {{slapd}}(8) server using SASL. Basic authentication service
can be set up by the LDAP administrator with a few steps, allowing
users to be authenticated to the slapd server as their LDAP entry.
With a few extra steps, some users and services can be allowed to
exploit SASL's authorization feature, allowing them to authenticate
themselves and then switch their identity to that of another user
or service.
OpenLDAP clients and servers are capable of authenticating via the
{{TERM[expand]SASL}} ({{TERM:SASL}}) framework, which is detailed
in {{REF:RFC2222}}. This chapter describes how to make use of
SASL in OpenLDAP.
There are several industry standard authentication mechanisms that
can be used with SASL, including Kerberos V4, GSSAPI, and some of
the Digest mechanisms. The standard client tools provided with
OpenLDAP, such as {{ldapsearch}}(1) and {{ldapmodify}}(1), will by
default attempt to authenticate the user to the {{slapd}}(8) server
using SASL. Basic authentication service can be set up by the LDAP
administrator with a few steps, allowing users to be authenticated
to the slapd server as their LDAP entry. With a few extra steps,
some users and services can be allowed to exploit SASL's authorization
feature, allowing them to authenticate themselves and then switch
their identity to that of another user or service.
This chapter assumes you have read {{Cyrus SASL for System
Administrators}}, provided with the {{PRD:Cyrus}} {{PRD:SASL}}
@ -33,7 +34,7 @@ uses LDAP operations to access information held in an LDAP server
is an application entity.
H2: Security Considerations
H2: SASL Security Considerations
SASL offers many different authentication mechanisms. This section
briefly outlines security considerations.
@ -458,8 +459,8 @@ search from an LDAP URL, the authorization request fails with
authorization DN ready to undergo approval.
If the authorization identity was provided in the second form, with
a "dn:" prefix, the string after the prefix is already in authorization
DN form, ready to undergo approval.
a {EX:"dn:"}} prefix, the string after the prefix is already in
authorization DN form, ready to undergo approval.
H3: Authorization rules
@ -479,11 +480,11 @@ authorization DN's entry to tell what authenticated DN a person
must be coming from in order to switch to that authorization DN.
The choice of which form to use is up to the administrator. Source
rules are checked first in the person's authentication DN entry,
and if none of the saslAuthzTo rules specify the authorization is
permitted, the saslAuthzFrom rules in the authorization DN entry
are then checked. If neither case specifies that the request be
honored, the request is denied with an "inappropriate access"
message. Since the default behaviour is to deny authorization
and if none of the {{EX:saslAuthzTo}} rules specify the authorization
is permitted, the {{EX:saslAuthzFrom}} rules in the authorization
DN entry are then checked. If neither case specifies that the
request be honored, the request is denied with an "inappropriate
access" message. Since the default behaviour is to deny authorization
requests, rules only specify that a request be allowed; there are
no negative rules telling what authorizations to deny.
@ -491,10 +492,10 @@ The value(s) in the two attributes are of the same form as the
output of the replacement pattern of a {{EX:saslRegexp}} directive:
either a DN or an LDAP URL. For example, if a saslAuthzTo value is
a DN, that DN is one the authenticated user can authorize to. On
the other hand, if the saslAuthzTo value is an LDAP URL, the URL
is used as an internal search of the LDAP database, and the
authenticated user can become ANY DN returned by the search. If an
LDAP entry looked like:
the other hand, if the {{EX:saslAuthzTo}} value is an LDAP URL,
the URL is used as an internal search of the LDAP database, and
the authenticated user can become ANY DN returned by the search.
If an LDAP entry looked like:
> dn: cn=WebUpdate,dc=example,dc=com
> saslAuthzTo: ldap://host/dc=example,dc=com??sub?objectclass=Person
@ -506,15 +507,16 @@ could authorize to any other LDAP entry under the search base
H4: Notes on Authorization rules
An LDAP URL in a saslAuthzTo or saslAuthzFrom attribute will return
a list of DN's, and that list must be linearly scanned. Searches
which return a long list can cause the authorization process to
take an uncomfortably long time. Also, searches should be performed
on attributes that have been indexed by slapd.
An LDAP URL in a {{EX:saslAuthzTo}} or {{EX:saslAuthzFrom}} attribute
will return a set of DNs. Each DN returned will be checked.
Searches which return a large set can cause the authorization
process to take an uncomfortably long time. Also, searches should
be performed on attributes that have been indexed by slapd.
To help produce more sweeping rules for saslAuthzFrom and saslAuthzTo,
the values of these attributes are allowed to be DN's with regular
expression characters in them. This means a source rule like
To help produce more sweeping rules for {{EX:saslAuthzFrom}} and
{{EX:saslAuthzTo}}, the values of these attributes are allowed to
be DNs with regular expression characters in them. This means a
source rule like
> saslAuthzTo: uid=.*,dc=example,dc=com

10
doc/guide/admin/tls.sdf Normal file
View File

@ -0,0 +1,10 @@
# Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
H1: Using TLS
OpenLDAP clients and servers are capable of using
Transport Layer Security {{TERM:TLS}} framework to provide
integrity and confidentiality protections and to support
LDAP authentication via SASL EXTERNAL.