Bug 436388 - LDAPI: introduce --enable-autobind to support AUTOBIND
Summary: LDAPI: introduce --enable-autobind to support AUTOBIND
Alias: None
Product: 389
Classification: Retired
Component: Directory Server
Version: 1.1.0
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Noriko Hosoi
QA Contact: Chandrasekar Kannan
Depends On:
Blocks: 249650 FDS1.2.0
TreeView+ depends on / blocked
Reported: 2008-03-06 21:59 UTC by Noriko Hosoi
Modified: 2015-01-04 23:31 UTC (History)
2 users (show)

Fixed In Version: 8.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2009-04-29 23:02:39 UTC

Attachments (Terms of Use)
cvs diff configure.ac Makefile.am (2.32 KB, patch)
2008-03-14 22:30 UTC, Noriko Hosoi
no flags Details | Diff
cvs diff configure.ac Makefile.am (1.67 KB, patch)
2008-05-09 22:35 UTC, Noriko Hosoi
no flags Details | Diff
cvs commit message (1.28 KB, text/plain)
2008-05-16 17:35 UTC, Noriko Hosoi
no flags Details
cvs diff configure.ac (806 bytes, patch)
2008-08-08 00:21 UTC, Noriko Hosoi
no flags Details | Diff

Description Noriko Hosoi 2008-03-06 21:59:49 UTC
Description of problem:
* Auto bind codes are all in the ENABLE_AUTOBIND macro.  Should we
  enable it and support the functionality?

rmeggins wrote:
> Yes, but turned off by default. 

Okay.  then should we add --enable-autobind to configure.ac?

rmeggins wrote:
> Yes.

Or should ENABLE_AUTOBIND be part of LDAPI?  I feel autobind is tightly coupled
with LDAPI, ENABLE_AUTOBIND could be replaced with ENABLE_LDAPI and merge
template-ldapi-autobind into template-ldapi-default?

rmeggins wrote:
> I think there may be some security conscious people who will not want to
enable autobind at all and will want to build without it.

Comment 1 Noriko Hosoi 2008-03-14 22:19:16 UTC
autoconf gets uid # and gid # from the LDAPI UNIX socket and retrieve the
matched entry from the backend to bind the server.

For example, 
Assume these are my uid # and gid # on the test system:
  $ id
  uid=12345(nhosoi) gid=12345(nhosoi)

Add this posix account to the server:
dn: uid=nhosoi, dc=example,dc=com
objectclass: top
objectclass: posixAccount
cn: noriko hosoi
uid: nhosoi
uidNumber: 12345
gidNumber: 12345
homeDirectory: /home/nhosoi
loginShell: bash
userPassword: nhosoi

Then, run the search against LDAPI UNIX socket without the bind user.  Autobind
internally searches an entry with the filter
(&(uidNumber=12345)(gidNumber=12345)) and binds using the found entry.
$ ldapsearch -H ldapi://%2fvar%2frun%2fslapd-laputa.socket/ -w nhosoi -Y
DIGEST-MD5 -b "dc=usersys,dc=redhat,dc=com" "(cn=*)"
SASL/DIGEST-MD5 authentication started
SASL username: nhosoi
SASL installing layers

Tested on RHEL4.

Comment 2 Noriko Hosoi 2008-03-14 22:28:19 UTC
To use autobind, ldapi, autobind, and maptoentries need to be turned on.
nsslapd-ldapifilepath: /var/run/slapd-laputa.socket
nsslapd-ldapilisten: on
nsslapd-ldapiautobind: on
nsslapd-ldapimaprootdn: cn=Directory Manager
nsslapd-ldapimaptoentries: on
nsslapd-ldapiuidnumbertype: uidNumber
nsslapd-ldapigidnumbertype: gidNumber
nsslapd-ldapientrysearchbase: dc=example,dc=com
nsslapd-ldapiautodnsuffix: cn=peercred,cn=external,cn=auth

(*correction*) in the sample in the comment #1, "dc=usersys, dc=redhat,dc=com"
should be replaced with  "dc=example,dc=com"

Comment 3 Noriko Hosoi 2008-03-14 22:30:00 UTC
Created attachment 298099 [details]
cvs diff configure.ac Makefile.am

Comment 5 Noriko Hosoi 2008-05-09 22:35:00 UTC
Created attachment 304990 [details]
cvs diff configure.ac Makefile.am


Description: introduced --enable-autobind
    By default, autobind is off.

Comment 6 Noriko Hosoi 2008-05-16 17:35:19 UTC
Created attachment 305718 [details]
cvs commit message

Reviewed and commented by Rich, Andrew, and Howard (Thank you!!)

Checked in into CVS HEAD.

Comment 7 Noriko Hosoi 2008-08-08 00:21:22 UTC
Created attachment 313763 [details]
cvs diff configure.ac

Problem description: AUTO-BIND was accidentally turned on.

These 2 are the only ldapi related attributes allowed in dse.ldif
nsslapd-ldapifilepath: /var/run/slapd-test.socket
nsslapd-ldapilisten: off

Comment 8 Noriko Hosoi 2008-08-08 16:20:27 UTC
(In reply to comment #7)
> Created an attachment (id=313763) [details]
> cvs diff configure.ac
> Problem description: AUTO-BIND was accidentally turned on.
> These 2 are the only ldapi related attributes allowed in dse.ldif
> nsslapd-ldapifilepath: /var/run/slapd-test.socket
> nsslapd-ldapilisten: off

It was not true.  AUTO-BIND was not on.

Changing the status back to MODIFIED.

Comment 9 Jenny Severance 2009-02-20 16:29:03 UTC
ldapiautobind is available for DS81 and is off by default.

Comment 10 Chandrasekar Kannan 2009-04-29 23:02:39 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.