Subject: RE: ACM permission

From: "Skovgaard, Erik" <[email-masked]>
Date: Mon, 9 Jul 2001 09:25:09 -0700

Mark,

That would be a problem.  A lot of us still use the userPassword for
authentication.  It must be possible to protect the password (including
performing filter matching) yet be able to use the compare operation on the
attribute.

Cheers,                ....Erik.

Erik Skovgaard
Siemens Meta-Directory Solutions
Phone: +1 604-204-0750
Fax:   +1 604-204-0760

-----Original Message-----
From: Mark Davidson [mailto:[email-masked]]
Sent: Monday, July 09, 2001 02:02
To: Skovgaard, Erik
Cc: [email-masked]
Subject: Re: ACM permission

> Would your example prevent me from using the Compare operation?
> 

Yes, as read access would cover all examination of the attribute. so
without read attribute you could not get the value, compare the value
or use the value in a filter etc.

Mark

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 09 Jul 2001 13:17:09 -0700

>performing filter matching) yet be able to use the compare operation on the

I'm not sure how permissions for compare relate to authentication.
The only operation which performs LDAP authentication is the
bind and its not controlled, per the I-D, by any permissions.

This said, I support having separate "assert" (compare/search
filter) permissions from read permissions as it is often useful
to allow one to assert a value but not allow them to read all
values.  The example (which I believe someone else gave) is
that there may a group where one is allowed to assert that
an entity is a member but not allowed to see the member list.

Kurt

---

From: Bruce Greenblatt <[email-masked]>
Date: Mon, 09 Jul 2001 14:20:05 -0700

>bind and its not controlled, per the I-D, by any permissions.

I think that what Erik is saying is that many applications leverage LDAP 
for their own authentication.  When a user tries to access that 
application, then internally the application takes the user supplied 
password, and issues an LDAP compare operation to verify the password's 
correctness.  This appears to be a widely used (but primitive) form of 
"single sign on".

Bruce

==============================================
Bruce Greenblatt, Ph. D.
Directory Tools and Application Services, Inc.
http://www.directory-applications.com

---

From: Joachim Gjesdal <[email-masked]>
Date: Tue, 17 Jul 2001 10:43:15 +0200

+1

Authorization and authentication are different things.

I hope not that old buggy applications will limit the level of security
defined by the ldap acl model.

joachim

"Kurt D. Zeilenga" wrote:

Kurt