Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of covener@gmail.com designates
 216.239.58.185 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type:content-transfer-encoding;
        b=v+Jh5t/cXJlgIHHK2HQbeoG/aqyKu4dmx6D4set+hye78hjrQSmQIocQKcOCL6qM5K
         PZQg/gjIcoRIobfwscAjlYWdJup8aL7vY1ntsgS70jJsrOm1RLpXP0yH3FLCtCpbOeWR
         +KJk5jWl1u6wkbAHOBIoKzle7vj6Z6XZO0TLs=
MIME-Version: 1.0
In-Reply-To: <5045A4D718CAB644BA24979206486B6006525574@hptimail03.HPTI.COM>
References: <1266856492.88283.ezmlm@httpd.apache.org>
	 <5045A4D718CAB644BA24979206486B6006525574@hptimail03.HPTI.COM>
Date: Mon, 22 Feb 2010 12:07:38 -0500
Message-ID: <1404e5911002220907x6959ff26o803e6982abc31a26@mail.gmail.com>
Subject: Re: [PATCH 48780] Input and improvements requested for suggested
	enhancement 48780
From: Eric Covener <covener@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Mon, Feb 22, 2010 at 11:46 AM, Thomas, Peter <pthomas@hpti.com> wrote:
> [ c.f. https://issues.apache.org/bugzilla/show_bug.cgi?id=3D48780 ]
>
> Eric Covener has commented, and I replied, to my suggested enhancement
> for mod_auth_ldap. =A0In this case, I am attempting to use LDAP for
> authorization, accepting authentication from another provider--this
> would most typically be mod_ssl, but I've seen other "in-family" cases
> in Bugzilla's history where people are working to integrate SSO with
> other authentication providers such as Kerberos [or more generally
> GSSAPI].
>
> The as-is implementation re-binds the LDAP connection using the user and
> password provided to perform the compare phase. =A0The proposed patch add=
s
> a [non-default] option to the LDAP provider that causes the compare
> phase to occur without a user-specific re-binding.

I haven't dug too deeply, but I didn't see how the attached patch
changed the authorization-time behavior.  Can you elaborate?

--=20
Eric Covener
covener@gmail.com