Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (nike.apache.org: domain of ayyagarikiran@gmail.com
 designates 209.85.210.178 as permitted sender)
MIME-Version: 1.0
Sender: ayyagarikiran@gmail.com
In-Reply-To: <4EF5B730.3090006@gmail.com>
References: <4EF5B730.3090006@gmail.com>
Date: Sat, 24 Dec 2011 17:14:07 +0530
Message-ID: 
 <CABzFU-eex6D_qBVKyUc07JusPoBZ5dBxsVy8or_VL9U-HA1UKQ@mail.gmail.com>
Subject: Re: Are non admin users allowed to read entries under ou=system ?
From: Kiran Ayyagari <kayyagari@apache.org>
To: Apache Directory Developers List <dev@directory.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Sat, Dec 24, 2011 at 4:57 PM, Emmanuel Lecharny <elecharny@gmail.com> wr=
ote:
> Hi,
>
> we have a strange test that checks if a normal user (not the admin) can r=
ead
> under ou=3Dsystem. This test is just totally wrong, as it uses the admin
> session, so I tried to fix it using a plain user. Sadly, oing so, I can r=
ead
> almost everyting under ou=3Dsystem.
>
> So I question the logic :
> - can a normal user read something under ou=3Dsystem (except his own reco=
rd)
> - should we instead forbid this user to read the 'uid=3Dadmin,ou=3Dsystem=
',
> 'ou=3Dconfiguration,ou=3Dsystem', 'ou=3Dgroups,ou=3Dsystem' and 'ou=3Duse=
rs,ou=3Dsystem'
> entries (and their children) ?
> - or should we just allow this user to read everything except if the ACI
> subsystem is set ?
>
> IMO, I'd rather go for the third option.
>
+1
> Note : the test is
> org.apache.directory.server.core.authz.AuthorizationServiceAsNonAdminIT.t=
estNoSearchByNonAdmin
> :
> =A0 =A0/**
> =A0 =A0 * Makes sure non-admin cannot search under ou=3Dsystem.
> =A0 =A0 *
> =A0 =A0 * @throws Exception if there are problems
> =A0 =A0 */
> =A0 =A0@Test
> =A0 =A0public void testNoSearchByNonAdmin() throws Exception
> =A0 =A0{
> =A0 =A0 =A0 =A0LdifEntry akarasulu =3D getUserAddLdif();
>
> =A0 =A0 =A0 =A0getService().getAdminSession().add(
> =A0 =A0 =A0 =A0 =A0 =A0new DefaultEntry( getService().getSchemaManager(),
> akarasulu.getEntry() ) );
>
> =A0 =A0 =A0 =A0try
> =A0 =A0 =A0 =A0{
> =A0 =A0 =A0 =A0 =A0 =A0ExprNode filter =3D FilterParser.parse(
> getService().getSchemaManager(), "(objectClass=3D*)" );
> =A0 =A0 =A0 =A0 =A0 =A0getService().getAdminSession().search( new Dn( "ou=
=3Dsystem" ),
> SearchScope.SUBTREE, filter , AliasDerefMode.DEREF_ALWAYS, null );
> =A0 =A0 =A0 =A0}
> =A0 =A0 =A0 =A0catch ( LdapNoPermissionException e )
> =A0 =A0 =A0 =A0{
> =A0 =A0 =A0 =A0 =A0 =A0assertNotNull( e );
> =A0 =A0 =A0 =A0}
> =A0 =A0}
>
> It passes with flying colors, just because we don't check anything...
>
> --
> Regards,
> Cordialement,
> Emmanuel L=E9charny
> www.iktek.com
>


--=20
Kiran Ayyagari