You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Yavor Trapkov <tr...@netscape.net> on 2003/03/16 09:28:33 UTC
[patch]2 : mod_auth_ldap doesn't effectively use the cache with "require
user User1 User2 .." directives]
I have posted this patch proposal a week ago and since I got only one reply - how to get round of the problem, and not any discussins about the problem itself or if my proposal is reasonable or not for the module development,
I follow the instruction on the DEV page to repost it again.
The LDAP authentication has an important place, especially for big organizations with a complex web environment. Since the mod_auth_ldap is an experimental module with apache 2.0.x it it not part of some big distributions (an example - RH 8.0).
I think the mod_auth_ldap shoud be developed and supported as a standard apache modile.
--
Yavor Trapkov
__________________________________________________________________
Try AOL and get 1045 hours FREE for 45 days!
http://free.aol.com/tryaolfree/index.adp?375380
Get AOL Instant Messenger 5.1 for FREE! Download Now!
http://aim.aol.com/aimnew/Aim/register.adp?promos=380455
Re: [patch]2 : mod_auth_ldap doesn't effectively use the cache with
"require user User1 User2 .." directives]
Posted by Graham Leggett <mi...@sharp.fm>.
Yavor Trapkov wrote:
> - firstly, it checks if the whole string "User1 User2 .." matches the CN
> of the
> authenticated user and as this is a very rear situation it almost always
> fails so each time we request a page, the WEB server sends a LDAP
> query as this
> is never cached as a negative result
We have to check this case first, otherwise we could have false positives.
A better workaround for this is to insist that all the tokens in the
require list be surrounded with "'s if there are spaces involved in the
search pattern. Then we can drop the whole line search entirely.
> - secondly, there is a loop that checks if every single entry in the list
> matches the CN of the authenticated user
> = it checks if this is a cached positive result
> = and if not it sends a LDAP query
> = this happens until it finds a match or the list finishes
If you have a need for more than one user on a require user line, then
you really should be using LDAP groups. LDAP groups are far more
managable anyway.
> - firstly, to check all words into the list only against the cache and
> not send
> LDAP queries
What you are asking for is negative caching, which I am not 100%
comfortable with. If a login fails due to some error (eg wrong
password), and the error is subsequently fixed in the directory, the
next time the query is tried with the correct password the comparison
will fail until the negative cache has timed out. This will not be
immediately obvious to the user, and will probably be reported as a bug.
> - at last, to check for the whole string "user1 user2 .." as this is very
> rear case and in almost all cases gives a negative result
It is not a rare case - if you match against cn (as iPlant directory
server does by default) you will almost always use this case.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: [patch]2 : mod_auth_ldap doesn't effectively use the cache with "require user User1 User2 .." directives]
Posted by Kyle Hamilton <wi...@sbcglobal.net>.
it sould be it would be a good thing for apache
-Kyle
www.kyleserver.com
----- Original Message -----
From: "Yavor Trapkov" <tr...@netscape.net>
To: <de...@httpd.apache.org>
Sent: Sunday, March 16, 2003 12:28 AM
Subject: [patch]2 : mod_auth_ldap doesn't effectively use the cache with
"require user User1 User2 .." directives]
> I have posted this patch proposal a week ago and since I got only one
reply - how to get round of the problem, and not any discussins about the
problem itself or if my proposal is reasonable or not for the module
development,
> I follow the instruction on the DEV page to repost it again.
>
> The LDAP authentication has an important place, especially for big
organizations with a complex web environment. Since the mod_auth_ldap is an
experimental module with apache 2.0.x it it not part of some big
distributions (an example - RH 8.0).
> I think the mod_auth_ldap shoud be developed and supported as a standard
apache modile.
>
> --
> Yavor Trapkov
>
>
> __________________________________________________________________
> Try AOL and get 1045 hours FREE for 45 days!
> http://free.aol.com/tryaolfree/index.adp?375380
>
> Get AOL Instant Messenger 5.1 for FREE! Download Now!
> http://aim.aol.com/aimnew/Aim/register.adp?promos=380455
>