I found out about this while researching groups and roles. Right now a user can search for users and get data including their email address. We do not want that
Example:
$ ldapsearch -x -D 'cn=greg,ou=kosmos.org,cn=users,dc=kosmos,dc=org' -b "ou=kosmos.org,cn=users,dc=kosmos,dc=org" "(&(objectclass=person))"
[snip]
# alfred, kosmos.org, users, kosmos.org
dn: cn=alfred,ou=kosmos.org,cn=users,dc=kosmos,dc=org
objectClass: top
objectClass: account
objectClass: person
objectClass: extensibleObject
cn: alfred
sn: alfred
uid: alfred
samaccountname: alfred
mail: alfred@example.com
We want users to not be able to search, only change their own mail or password
I found out about this while researching groups and roles. Right now a user can search for users and get data including their email address. We do not want that
Example:
```
$ ldapsearch -x -D 'cn=greg,ou=kosmos.org,cn=users,dc=kosmos,dc=org' -b "ou=kosmos.org,cn=users,dc=kosmos,dc=org" "(&(objectclass=person))"
[snip]
# alfred, kosmos.org, users, kosmos.org
dn: cn=alfred,ou=kosmos.org,cn=users,dc=kosmos,dc=org
objectClass: top
objectClass: account
objectClass: person
objectClass: extensibleObject
cn: alfred
sn: alfred
uid: alfred
samaccountname: alfred
mail: alfred@example.com
```
Needs something similar to https://www.zytrax.com/books/ldap/ch5/step2.html#step2-access but for 389 Directory Server (the link is for OpenLDAP)
We want users to not be able to search, only change their own mail or password
They shouldn't see any data from other users really. Not just the email address.
They shouldn't see any data from other users really. Not just the email address.
greg
changed title from LDAP users should not be able to list other users' email address to LDAP users should only be able to change their own password and email2020-02-04 18:43:26 +00:00
This example denies everything (reading, search, writing, etc) for all users (except for the admin account, since its dn is not under dc=kosmos,dc=org) but a user can change their password. We should also create read-only accounts that can perform the LDAP searches for the different services, probably using groups to set the ACIs
[Setting ACIs](https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/managing_access_control) is what we need.
```ldif
# kosmos.org
dn: dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///dc=kosmos,dc=org") (version 3.0; acl "user-deny-all"; deny (all) userdn="ldap:///dc=kosmos,dc=org";)
aci: (target="ldap:///dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "user-write-own-password"; allow (write) userdn="ldap:///self";)
```
This example denies everything (reading, search, writing, etc) for all users (except for the admin account, since its dn is not under `dc=kosmos,dc=org`) but a user can change their password. We should also create read-only accounts that can perform the LDAP searches for the different services, probably using groups to set the ACIs
greg
self-assigned this 2020-02-05 13:31:18 +00:00
I don't think akkounts-api should have credentials to a master admin account. But it does need to write to the directory.
If there are ACLs for reading, then there are probably also ACLs for writing, no?
I don't think `akkounts-api` should have credentials to a master admin account. But it does need to write to the directory.
If there are ACLs for reading, then there are probably also ACLs for writing, no?
The title of this issue is still misleading. LDAP users shouldn't be able to directly change anything in the directory. They should always go through akkounts, and I think we should enforce 2FA there for everyone as well.
The title of this issue is still misleading. LDAP users shouldn't be able to directly change anything in the directory. They should always go through akkounts, and I think we should enforce 2FA there for everyone as well.
I agree that everything should be locked down (and the LDAP server should only be accessible by servers that need access) once we have added these features to akkounts. However I think the changes for akkounts should go in another issue. For now we need users to be able to change their passwords.
I agree that everything should be locked down (and the LDAP server should only be accessible by servers that need access) once we have added these features to akkounts. However I think the changes for akkounts should go in another issue. For now we need users to be able to change their passwords.
greg
changed title from LDAP users should only be able to change their own password and email to LDAP users should only be able to change their own password2020-02-07 15:42:27 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
I found out about this while researching groups and roles. Right now a user can search for users and get data including their email address. We do not want that
Example:
Needs something similar to https://www.zytrax.com/books/ldap/ch5/step2.html#step2-access but for 389 Directory Server (the link is for OpenLDAP)
We want users to not be able to search, only change their own mail or password
They shouldn't see any data from other users really. Not just the email address.
LDAP users should not be able to list other users' email addressto LDAP users should only be able to change their own password and emailSetting ACIs is what we need.
This example denies everything (reading, search, writing, etc) for all users (except for the admin account, since its dn is not under
dc=kosmos,dc=org) but a user can change their password. We should also create read-only accounts that can perform the LDAP searches for the different services, probably using groups to set the ACIsI don't think
akkounts-apishould have credentials to a master admin account. But it does need to write to the directory.If there are ACLs for reading, then there are probably also ACLs for writing, no?
By the way, shouldn't we also restrict access to the entire LDAP server by IP address? Why does a user have to be able to connect to it directly?
Yes, there are ACIs for everything. We can create an account for
akkounts-apithat can create users and nothing elseI think you mean create and query users.
The title of this issue is still misleading. LDAP users shouldn't be able to directly change anything in the directory. They should always go through akkounts, and I think we should enforce 2FA there for everyone as well.
I agree that everything should be locked down (and the LDAP server should only be accessible by servers that need access) once we have added these features to akkounts. However I think the changes for akkounts should go in another issue. For now we need users to be able to change their passwords.
OK, but then they still don't need to be able to change their email address.
Makes sense, I'm fixing the title
LDAP users should only be able to change their own password and emailto LDAP users should only be able to change their own password