[Fedora-directory-users] Binding using attribute other than CN

[Pete Rowley]

Richard Gibson wrote:

> When attempting to bind using the following (as taken from the access 
> log):
> BIND dn="ntUserDomainId=Richard 
> Smith,ou=People,dc=fedora,dc=test,dc=com" method=128 version=3
>
> ...I get "No such object". This user does exist though. Is binding 
> using the ntUserDomainId out of the question?
>
When you bind you are not binding with an attribute, you specify the 
whole dn of the entry to bind with (and there is only one DN per entry) 
- that is the protocol specification for simple bind.  Usually a client 
will allow "login" by requesting a username or some such and then 
searching the directory for that value in one or more attributes that it 
is configured or coded for, retrieving the dn of the entry returned and 
then binding with that.  So end users need never see a DN in the normal 
course of events (and in fact DNs are not /supposed/ to be seen by end 
users).

> I notice from the following discussion that the same sort of thing is 
> possible in Active Directory, although I have not tried it myself:
> http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188 
> <http://groups.google.co.uk/group/microsoft.public.adsi.general/browse_thread/thread/b5fc22bfdd9079fe/f1caf3c9cf6c8188?lnk=st&q=ldap+bind+only+via+CN%3F&rnum=1&hl=en#f1caf3c9cf6c8188>

Specifically, no, this mechanism is not supported.  We support SASL, but 
not SPNEGO.  We definitely do not support bind based on attribute value 
where the protocol documents say a DN should be.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20060112/20148c61/attachment.bin>