<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2">
</HEAD>
<BODY>
So, I'm trying to implement a login running inside Webspeed inside Apache inside linux. There are good reasons to do this inside this application program and not just let Apache do it. <BR>
<BR>
So, what I get from user is network-user-id (let's call him "bob") and password. <BR>
<BR>
What I need to know is:<BR>
<BLOCKQUOTE>
Does this userid exist (samaccountname=%s), is the password provided correct?<BR>
if above is good, is this user memberof a specific group?<BR>
<BR>
</BLOCKQUOTE>
What I've got working as proof-of-concept is: <BR>
<BLOCKQUOTE>
A. Do a simple bind to LDAP with an admin/service account as a DN, and search for this user-id (samaccountname=bob), and get back the DN for user "bob". Using $OpenLDAP: ldapsearch 2.4.39<BR>
<BR>
B. Then do ANOTHER simple bind to LDAP using "bob"s as DN, and "bob"s password, and return the memberof attribute. That fails if I don't give it the correct password. <BR>
<BR>
</BLOCKQUOTE>
I don't claim to know LDAP; but isn't this convoluted? Is there a way to do this in one shot with the ldapsearch command? I can do it this way, but it seems clunky. <BR>
<BR>
<BR>
The other topic is security: I was intending to invoke the ldapsearch from inside the Apache/Webspeed/Progress/ABL application as a "input-output through", meaning we run this and read/write its STDIn/StdOut. Best practices would indicate we'd want to hide the passwords. We don't want someone doing a 'top' command seeing passwords. Unfortunately, this does not seem readily possible. <BR>
<BLOCKQUOTE>
The openldap ldapsearch has a -W option to prompt for passwd, but that appears to not read StdIn, but rather /dev/tty. So I cannot feed it passwords that way. <BR>
</BLOCKQUOTE>
<BR>
<BLOCKQUOTE>
There is a "-f" option, which offers a - flavor to read StdIn, but I don't see any examples of what the input to -f looks like, eg: can I specify password there. <BR>
<BR>
There is a -y option to specify a file which contains the password. ok, I could write the file, put it somewhere not readable by anybody but Apache, run ldapsearch, and then delete the file. Still, that doesn't smell like best practices to me. <BR>
<BR>
</BLOCKQUOTE>
So, it seems like either I'm missing something or the use of ldapsearch for password validation opens up holes and less than best practices. Yes, I could dork around with calling shared libraries, and then fight that portability battle between linux and Solaris. Why is it so hard? <BR>
<BR>
Neal Rhodes<BR>
MNOP Ltd.
</BODY>
</HTML>