upstream/openldap
1
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2026-01-26 16:52:55 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

if "disallow bind_simple_unprotected", require at least SSF of 2

Browse source
This commit is contained in:
Kurt Zeilenga 2002-10-08 01:06:49 +00:00
parent 90e320398a
commit 36fca96695
2 changed files with 7 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
doc/man/man5/slapd.conf.5
View file

@ -179,13 +179,14 @@ disables acceptance of anonymous bind requests.
.B bind_simple
disables simple (bind) authentication.
.B bind_simple_unprotected
disables simple (bind) authentication when integrity and/or confidentiality
protections (e.g. TLS) are not in place. The level of protection required
is determined by the
disables simple (bind) authentication when confidentiality
protection (e.g. TLS) is not in place. The level of confidential
protection to require can be adjusted using the
.I overall security strength factor
(as set by the
using the
.B security
directive).
directive. If this factor is not set (or set to integrity only),
any confidentiality protection is sufficient.
.B bind_krbv4
disables Kerberos V4 (bind) authentication.
.B tls_2_anon

2
servers/slapd/bind.c
View file

@ -419,7 +419,7 @@ do_bind(
goto cleanup;
} else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED )
&& ( op->o_ssf < global_ssf_set.sss_ssf ))
&& ( op->o_ssf <= 1 || op->o_ssf < global_ssf_set.sss_ssf ))
{
rc = LDAP_CONFIDENTIALITY_REQUIRED;
text = "unwilling to perform simple authentication "