Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of elecharny@gmail.com
 designates 209.85.212.176 as permitted sender)
Message-ID: <550A6CC0.7050401@gmail.com>
Date: Thu, 19 Mar 2015 07:29:20 +0100
From: =?UTF-8?B?RW1tYW51ZWwgTMOpY2hhcm55?= <elecharny@gmail.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:31.0) Gecko/20100101 Thunderbird/31.5.0
MIME-Version: 1.0
To: users@directory.apache.org
Subject: Re: checking group membership during while binding
References: <BLU179-W7118CC397C94179E06BD39FF000@phx.gbl>
In-Reply-To: <BLU179-W7118CC397C94179E06BD39FF000@phx.gbl>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Le 19/03/15 00:50, Michael Perelman a =C3=A9crit :
> While using Apache LDAP java APIs, is there a way to check for group me=
mbership during the binding process? Or is the only way to determine grou=
p membership is by doing a regular lookup, and only after binding? The la=
tter approach may not work because the authenticated user may not have th=
e access rights to perform any lookups, thereby forcing the use of an LDA=
P administrator. That means that its credentials need to be stored somewh=
ere outside the LDAP server in order for the client code to use its accou=
nt for the aforementioned lookup. What approach would you suggest?
>  		 	   		 =20
I'm not sure what you want to do here. What is your "check for group
membership" in LDPA terms ?

If you mean you want to look at the content of the 'member' attribute,
then yes, a lookuo is the way. If you don't want to do that regularly,
then using the persistentSearch contrl might be an option : you will be
informed of any change done on this attribute.

Obviously, you will depend on yoru LDAP server settings to have access
to this attribute. If your server does not allow operations to be done
without any binding (yes, you can do a search without doing any bind,
this is allowed by the protocol, but most generally forbidden by some
server configuration), then depending on the authorization, you might
also have to pick the right user to complete such a lookup.

All in all, it's really a server configuration problem...