Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: [PATCH 48780] Input and improvements requested for suggested
 enhancement 48780
Date: Mon, 22 Feb 2010 11:46:26 -0500
Message-ID: <5045A4D718CAB644BA24979206486B6006525574@hptimail03.HPTI.COM>
In-Reply-To: <1266856492.88283.ezmlm@httpd.apache.org>
Thread-Topic: [PATCH 48780] Input and improvements requested for suggested
 enhancement 48780
Thread-Index: Acqz3PPYgC7minyTQYWj4LKQkAp3swAAHOgQ
References: <1266856492.88283.ezmlm@httpd.apache.org>
From: "Thomas, Peter" <pthomas@HPTI.com>
To: <dev@httpd.apache.org>

[ c.f. https://issues.apache.org/bugzilla/show_bug.cgi?id=3D48780 ]

Eric Covener has commented, and I replied, to my suggested enhancement
for mod_auth_ldap.  In this case, I am attempting to use LDAP for
authorization, accepting authentication from another provider--this
would most typically be mod_ssl, but I've seen other "in-family" cases
in Bugzilla's history where people are working to integrate SSO with
other authentication providers such as Kerberos [or more generally
GSSAPI].

The as-is implementation re-binds the LDAP connection using the user and
password provided to perform the compare phase.  The proposed patch adds
a [non-default] option to the LDAP provider that causes the compare
phase to occur without a user-specific re-binding.

In the comments, I contemplate various "sanity checks" to prevent--or at
the very least strongly caution against--inappropriate, insecure uses of
this option.

--Pete