NAME¶
Net::LDAP::Control::ProxyAuth - LDAPv3 Proxy Authorization control object
SYNOPSIS¶
use Net::LDAP;
use Net::LDAP::Control::ProxyAuth;
$ldap = Net::LDAP->new( "ldap.mydomain.eg" );
$auth = Net::LDAP::Control::ProxyAuth->new( authzID => 'dn:cn=me,ou=people,o=myorg.com' );
@args = ( base => "cn=subnets,cn=sites,cn=configuration,$BASE_DN",
scope => "subtree",
filter => "(objectClass=subnet)",
callback => \&process_entry, # Call this sub for each entry
control => [ $auth ],
);
while(1) {
# Perform search
my $mesg = $ldap->search( @args );
# Only continue on LDAP_SUCCESS
$mesg->code and last;
}
DESCRIPTION¶
"Net::LDAP::Control::ProxyAuth" provides an interface for the creation
and manipulation of objects that represent the "Proxy Authorization
Control" as described by RFC 4370.
It allows a client to be bound to an LDAP server with its own identity, but to
perform operations on behalf of another user, the "authzID".
With the exception of any extension that causes a change in authentication,
authorization or data confidentiality, a single "Proxy Authorization
Control" may be included in any search, compare, modify, add, delete, or
moddn or extended operation.
As cqrequired by the RFC, the criticality of this control is automatically set
to TRUE in order to protect clients from submitting requests with other
identities that they intend to.
CONSTRUCTOR ARGUMENTS¶
In addition to the constructor arguments described in Net::LDAP::Control the
following are provided.
- authzID
- The authzID that is required. This is the identity we are
requesting operations to use.
- proxyDN
- In early versions of the drafts to RFC 4370,
draft-weltman-ldapv3-proxy-XX.txt, the value in the control and thus the
constructor argument was a DN and was called "proxyDN". It
served the same purpose as "authzID" in recent versions of
"proxyAuthorization" control.
Please note: Unfortunately the OID and the encoding or the "Proxy
Authorization Control" changed significantly between early versions of
draft-weltman-ldapv3-proxy-XX.txt and the final RFC.
Net::LDAP::Control::ProxyAuth tries to cope with that situation and changes
the OID and encoding used depending on the constructor argument.
With "proxyDN" as constructor argument the old OID and encoding are
used, while with "authzID" as constructor argument the new OID and
encoding are used. Using this logic servers supporting either OID can be
handled correctly.
METHODS¶
As with Net::LDAP::Control each constructor argument described above is also
available as a method on the object which will return the current value for
the attribute if called without an argument, and set a new value for the
attribute if called with an argument.
SEE ALSO¶
Net::LDAP, Net::LDAP::Control,
AUTHORS¶
Olivier Dubois, Swift sa/nv based on Net::LDAP::Control::Page from Graham Barr
<gbarr@pobox.com>. Peter Marschall <peter@adpm.de> added authzID
extensions based on ideas from Graham Barr <gbarr@pobox.com>.
Please report any bugs, or post any suggestions, to the perl-ldap mailing list
<perl-ldap@perl.org>
COPYRIGHT¶
Copyright (c) 2001-2004 Graham Barr. All rights reserved. This program is free
software; you can redistribute it and/or modify it under the same terms as
Perl itself.