Re: [PATCH]: LDAP Authz (was: Ldap Authorization)

[Brad Nicholes <BN...@novell.com>]

   I took a quick look at this patch and it seems to work well as long
as all of the listed attributes are OR'ed together.  I don't have a good
suggestion yet, but is there a way to implement the logic so that
attributes could be also AND'ed together?  Or even a NOT-EQUAL
operation?

Brad

>>> rmorgan@pobox.com Sunday, October 31, 2004 2:03:53 PM >>>

I've opened an enhancement in bugzilla:

http://issues.apache.org/bugzilla/show_bug.cgi?id=31913 

I have attached the patch here for review.  I'd also like to get this
committed to the 2.0 tree so people can start taking advantage of the
feature without waiting for 2.2.

Thoughts?

Re: [PATCH]: LDAP Authz (was: Ldap Authorization)

[Ryan Morgan <rm...@pobox.com>]

Thats a tricky one..  We could introduce a new directive
AuthLDAPRequireAll on|off that would control this behavior.

I'm open to other ideas too..

-Ryan

On Nov 2, 2004, at 5:19 PM, Brad Nicholes wrote:

>    I took a quick look at this patch and it seems to work well as long
> as all of the listed attributes are OR'ed together.  I don't have a 
> good
> suggestion yet, but is there a way to implement the logic so that
> attributes could be also AND'ed together?  Or even a NOT-EQUAL
> operation?
>
> Brad
>
>>>> rmorgan@pobox.com Sunday, October 31, 2004 2:03:53 PM >>>
>
> I've opened an enhancement in bugzilla:
>
> http://issues.apache.org/bugzilla/show_bug.cgi?id=31913
>
> I have attached the patch here for review.  I'd also like to get this
> committed to the 2.0 tree so people can start taking advantage of the
> feature without waiting for 2.2.
>
> Thoughts?
>

Re: [PATCH]: LDAP Authz (was: Ldap Authorization)

[Jim Jagielski <ji...@jaguNET.com>]

Good suggestion. I am +1 for the patch as-is with the intent
of looking into adding the below

On Nov 3, 2004, at 5:04 AM, Graham Leggett wrote:

> Brad Nicholes wrote:
>
>>    I took a quick look at this patch and it seems to work well as long
>> as all of the listed attributes are OR'ed together.  I don't have a 
>> good
>> suggestion yet, but is there a way to implement the logic so that
>> attributes could be also AND'ed together?  Or even a NOT-EQUAL
>> operation?
>
> I think the best way to do this probably is instead of saying "require 
> ldap-attribute" you say "require LDAP filter".
>
> In other words, like this:
>
> require filter (objectclass=specialPerson)
>
> or
>
> require filter (host=somehost.com)
>
> This supports more complicated stuff, like this:
>
> require filter (&(objectclass=specialPerson)(host=somehost.com))
>
> Regards,
> Graham
> --
>
--
=======================================================================
  Jim Jagielski   [|]   jim@jaguNET.com   [|]   http://www.jaguNET.com/
   "There 10 types of people: those who read binary and everyone else."

Re: [PATCH]: LDAP Authz (was: Ldap Authorization)

[Graham Leggett <mi...@sharp.fm>]

Brad Nicholes wrote:

>    I took a quick look at this patch and it seems to work well as long
> as all of the listed attributes are OR'ed together.  I don't have a good
> suggestion yet, but is there a way to implement the logic so that
> attributes could be also AND'ed together?  Or even a NOT-EQUAL
> operation?

I think the best way to do this probably is instead of saying "require 
ldap-attribute" you say "require LDAP filter".

In other words, like this:

require filter (objectclass=specialPerson)

or

require filter (host=somehost.com)

This supports more complicated stuff, like this:

require filter (&(objectclass=specialPerson)(host=somehost.com))

Regards,
Graham
--