LDAP authorization with Sunone 5.2 P4

Sun Directory Server does support time-based constraints in Access Controls, using the bind rules and more specifically the keywords: dayofweek, timeofday.

But it is not possible to reject Bind requests (Authentication requests) with these. Instead Directory Proxy Server can be used as a front end to DS for this purpose.

Regards,

Ludovic.

ludovicpa at 2007-7-8 2:18:18 >

If I assume you don't have anonymous access turned on and using application (nonpeople) account to do lookup on user's uid to find user's real DN to use in BIND.

If the above is true then you can setup ACL, as Ludovic mentioned on application account so that it won't find user's DN in the above search using uid, hence it can't submit BIND

Thanks

Krishna Kusupudi

kusupudia at 2007-7-8 2:18:18 >

Hi Ludovic,

Use Case : Let us say a Remote Access VPN user /Webvpn user logs in and the authentication/authorization request is being forwarded to the Sun one Directory Server.

Based on the access-hours attributes configured for the user on the Directory Server the bind request should be granted permission or deniod permission.

We have this facility in Microsoft Active Directory. Let me know if you need more information on this.

bkrishna79a at 2007-7-8 2:18:18 >