On su, 26 helmi 2023, Gianluca Amato via FreeIPA-users wrote:
Hi,
I have a FreeIPA 4.10 installation with a Squid proxy server using the
ext_kerberos_ldap_group_acl helper for authorizations. At some point
the helper stopped working correctly. The problem is that
ext_kerberos_ldap_group_acl uses the memberuid attribute, which is only
available in the "cn=groups,cn=compat,dc=labeconomia,dc=unich,dc=it"
subtree. Unfortunately, it seems that traversing the compat subtree is
only possible when specifying a search base.
For example, the command
ldapsearch -H <host> "(uid=studente)"
returns the user
"uid=studente,cn=users,cn=accounts,dc=labeconomia,dc=unich,dc=it"
If I want to get the corresponding user in the compat subtree, I need to
specify a search base as in
ldapsearch -H <host> -b "cn=compat,dc=labeconomia,dc=unich,dc=it"
"(uid=studente)"
which correctly returns
"uid=studente,cn=users,cn=compat,dc=labeconomia,dc=unich,dc=it"
Now I wonder: is this the correct behavior ? And if this is correct, why did
ext_kerberos_ldap_group_acl use to work in the past ?
There are two parts here:
- slapi-nis was enhanced to tighten up its processing to prevent some
of performance issues, with a side-effect of not responding to too
wide queries anymore, and
- there is a bug in Squid's helper that ignores a base DN setting.
I fixed the latter one with
https://github.com/squid-cache/squid/pull/1207 (there are few backports
to maintenance branches as well) but the former one is still being
investigated.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
