New answers tagged


ACLs also affect the authentication step. When using simple bind (with DN and password) you have to grant auth right to attributes entry and userPassword on the entry to be authenticated. But AFAICS your last ACL effectively blocks auth access to pseudo-attribute entry. I'd try as last ACL (not tested): olcAccess: {2}to * by self read by * auth


When using Kerberos as SSO protocol: If a user logs into his/her workstation there's a ticket-granting ticket (TGT) stored in the user's session (e.g. file). With this TGT the user can obtain service tickets for accessing other "kerberized" services, e.g. SSH servers. This assumes that your security policy allows all systems to be accessed with a common ...


This might happen when the LDAP database has a PosixGroup foo with attribute memberUid with value jdoe The user might or might not exist, but the username does exist in the PosixGroup foo This might be a security risk, when a (different) user with username jdoe is added to the LDAP-database again, when you do not want the user to be part of foo.

Top 50 recent answers are included