Mailing-List: contact infrastructure-dev-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: infrastructure-dev@apache.org
Received-SPF: pass (nike.apache.org: domain of sa3ruby@gmail.com designates
 209.85.214.181 as permitted sender)
MIME-Version: 1.0
Sender: sa3ruby@gmail.com
In-Reply-To: <223E4DC4-F88F-4CC9-80C6-5B8D9C1C2C8C@pc-tony.com>
References: <FE61224C-1754-41E1-9C69-A638B5563691@toolazydogs.com>
	<E2793440-BD68-4C05-9A36-A6C3CBABD4A6@apache.org>
	<74DE6ABC-FB0E-401F-8A67-10EDCBC7D240@toolazydogs.com>
	<CAOGo0VZX2f_a1yJH36DnxTDoBtH_mZew38C4u4YpfVdFHN+_YA@mail.gmail.com>
	<31F87974-BC9B-4279-8960-3867C3432720@toolazydogs.com>
	<CAFG6u8F3z-jfHBKGwui45YPW9p+AHx8-QM=He_VDR0iKagbNJA@mail.gmail.com>
	<CAOGo0VZbBmZiVz0rML-4FjGZR0Uvi_9XtyLM0c3ZdA=SPWTK3Q@mail.gmail.com>
	<5112E265-B761-4BD2-91F8-96D22D2DE089@toolazydogs.com>
	<223E4DC4-F88F-4CC9-80C6-5B8D9C1C2C8C@pc-tony.com>
Date: Tue, 28 May 2013 18:11:53 -0400
Message-ID: 
 <CAFG6u8HLjsDkhCM2p0y6CcC91hdVsSk_bfOfUs6PkFfb7F70JQ@mail.gmail.com>
Subject: Re: Canonical sources for information
From: Sam Ruby <rubys@intertwingly.net>
To: infrastructure-dev@apache.org
Content-Type: text/plain; charset=UTF-8

On Tue, May 28, 2013 at 5:55 PM, Tony Stevenson <tony@pc-tony.com> wrote:
>
> On 28 May 2013, at 21:50, Alan Cabrera <adc@toolazydogs.com> wrote:
>>>
>>> This requires an LDAP login, which means the code probably cannot be
>>> safely automated to run on a shared host, as the password would need
>>> to be stored somewhere.
>>>
>>> Would it be possible to provide access to the public information
>>> without requiring a login?
>>
>> How about returning just public information when credentials are not supplied and returning full information if credentials are supplied?
>
> The issue here is that your credentials are used to bind to LDAP to collect this data, AIUI.

Actually, I don't believe so.  Anybody with shell access to certain
machines can obtain this data (read only).  This includes role
accounts, including the one used by the web server.

Given the way HTTP authentication works, it probably would be best if
we want to provide an unauthenticated service that we do so with a
separate URI.

- Sam Ruby