Not sure I see a need for different non-anon accounts for ldapauth and ldapdata? A single account can have appropriate permissions to safely do both. E.g., read-only across the directory but writeable to certain directory entry attributes.

Even if there is a need, ldapdata should use ldapauth's non-anon account by default. Otherwise you'll have more support requests like #417870: Uses anon binds even when non-anonymous seach is configured.

Comments

miglius’s picture

miglius commented
Status: Active » Closed (works as designed)

There are so many different ways a LDAP server can be configured so I would rather leave this as it is. For instance, a LDAP server can be readable and searched by anonymous user. Then non-anonymous account is not needed for ldapauth to work. But a non-anonymous account will be needed to sync ldaptada (if user itself cannot write to LDAP).

aren cambre’s picture

aren cambre commented
Title: Use ldapauth non-anon account for ldapdata » Use ldapauth non-anon account for ldapdata by default
Status: Closed (works as designed) » Active

Can you make it so that ldapdata uses the ldapauth non-anon account unless otherwise specified? I'll bet 97% of the time people will use it that way. Otherwise you're forcing overconfiguration for the vast majority of users.

cgmonroe’s picture

cgmonroe commented
Status: Active » Closed (won't fix)

Marking as "won't fix"... unless someone want to come up with a patch.

It's not that much of a hardship to copy dn's and passwords if needed and it makes people aware of the access needs. Plus with the new import/export and features support, duplicating ldap settings between servers is easy.