Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (asf.osuosl.org: domain of aok123@bellsouth.net designates
 205.152.59.70 as permitted sender)
Message-ID: <44D34526.5090005@bellsouth.net>
Date: Fri, 04 Aug 2006 09:01:26 -0400
From: Alex Karasulu <aok123@bellsouth.net>
User-Agent: Thunderbird 1.5.0.5 (X11/20060728)
MIME-Version: 1.0
To: Apache Directory Developers List <dev@directory.apache.org>
Subject: Re: Binding with enything but a dn?
References: <44D31343.1010601@levigo.de>
In-Reply-To: <44D31343.1010601@levigo.de>
Content-Type: text/plain; charset=ISO-8859-15; format=flowed
Content-Transfer-Encoding: 8bit

J�rg Henne wrote:
> Hi all,
> 
> MS Active Directory supports the use at least two forms ob Bind-DNs, 
> which are not precisely DNs:
> - domain\username
> - username@dom.ain
> 
> The way DS is currently implemented, there is no way to let an 
> authenticator support principal names which are not in DN format, 
> because the DN format of the principal is enforced very early on in the 
> protocol handler.
> 
> The way clients usually authenticate users seems to be
> - search for the user using either an anonymous bind or an 
> administrative user id
> - use the retrieved DN to attempt a bind using the supplied credentials.
> 
> Allowing non-DN format bind DNs would have two benefits IMHO:
> - let AD become more MSAD compatible
> - allow for more efficient authentication by getting rid of the extra 
> search.
> 
> WDYT?

Interesting idea.  As far as having to do a search we're still going to 
have to lookup something to perform the authentication on bind.  Even if 
we're looking up the user on the native OS or in the server's DIT we 
still have some kind of search in effect.  Using native OS 
authentication is a different matter in itself.

We could implement this kind of authentication name format by trying to 
detect the syntax and then appropriately transforming the name into a DN 
based on the domain to dn mapping in RFC 3088.  See section 2.1 of [0] 
for a means to convert a DN to a domain name and vice versa.

This way principal jhenne@apache.org or apache.org\jhenne would be 
transformed to uid=jhenne,dc=apache,dc=org before proceeding with the 
bind operation.

How does this sound?

Alex

-----
[0] - http://www.apps.ietf.org/rfc/rfc3088.html