Re: [ldapext] DBIS - new IETF drafts

[Michael Ströder <[e-mail]>]

Mark R Bannister wrote:
> On 08/01/2014 18:57, Michael Ströder wrote:
>> Arthur de Jong wrote:
>>> I personally like the use of flat names to describe group membership. It
>>> makes the semantics much simpler than dealing with things like the
>>> member or uniqueMember attribute (at least from a client implementation
>>> perspective).
>>>
>>> The use of distinguished names may seem more logical from an LDAP
>>> structure point of view, but you will have to dereference any DN to a
>>> user name for building up a group entry resulting in potentially a lot
>>> of search operations to get complete data.
>> Using DNs allows to implement server-side access control. I'm not a friend of
>> letting client-side demons enforce the access control because if a machine got
>> hacked the attacker can find out more about the infrastructure.
> 
> Please will you give me a more solid example of what you are referring to re
> access control?  What is it exactly you think you'd like to do with regards to
> group membership and server-side access control?

If the client system *individually* binds to the LDAP server you can implement
server-side access control in the LDAP server. During the last weeks I defined
a schema and OpenLDAP ACLs for such a deployment. Nothing to publish yet since
this is done for a customer.

Similar to what Simo described for IPA I use server groups (IPA host groups)
with rights assigned to user groups.

In opposite to all other implementations all clients MUST individually bind to
the LDAP server and server-side ACLs limit access to posixAccount, posixGroup,
server group and sudoRole entries.

I have to clarify if I'm allowed to disclose further details about this which
will take a while.

Ciao, Michael.