Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-08-07 Thread Matt S Trout
On Thu, Aug 07, 2008 at 05:29:38PM +0200, Buchan Milne wrote:
> On Thursday 24 July 2008 04:38:30 Matt S Trout wrote:
> > On Wed, Jul 23, 2008 at 08:29:42AM -0500, Peter Karman wrote:
> > > On 07/22/2008 10:37 PM, Matt S Trout wrote:
> > > > On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> > > >> Also, somewhat apropos, I have a
> > > >> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> > > >> stuff.  The LDAP modules didn't work for me because they want to bind
> > > >> anonymously and retrieve the crypted password, whereas AD just wants
> > > >> to authenticate with a bind.
> > > >
> > > > So, having established this isn't true.
> > > >
> > > > Could you perhaps instead post a message asking why your config of the
> > > > main LDAP store didn't work so we can figure out what configuration
> > > > problem you had and document it?
> > >
> > > likely he is missing a 'binddn' and 'bindpw' config setting. The initial
> > > bind() will try anonymously if those are not set. What I usually do for
> > > Active Directory is create a user specifically for use with Net::LDAP
> > > (and by extension, C::A::Store::LDAP), and then do all my initial binds
> > > with that user/pass.
> >
> > Hmmm. Should there be an alternative option where (if the user DN is
> > deterministic from the username) it skips the first part and just
> > tries the bind with $generated_dn and $supplied_password (where
> > $generated_dn is the result of a subref/sprintf pattern/whatever
> > supplied in config) ?
> 
> A directory isn't an RDBMS; one should never assume that the naming attribute 
> is the same attribute used for the "username". One should avoid generating 
> DNs 
> in anything but code that initially provisions the entry.

One should be able to get a suitable user provisioned that one uses to do
the initial search.

>From what people seemed to be saying, in the real world this isn't always the
case.

I was suggesting that having such a feature available would permit people
to still use the credential in this case rather than having to write an
entire new one.

Just because you "should avoid" something, sadly, doesn't always mean you
-can- avoid it. Features designed for an imperfect world are important,
although it's also important that they're documented as such and that the
preferred approach is mentioned.

-- 
  Matt S Trout   Need help with your Catalyst or DBIx::Class project?
   Technical Directorhttp://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/http://www.shadowcat.co.uk/servers/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-08-07 Thread Buchan Milne
On Thursday 24 July 2008 04:38:30 Matt S Trout wrote:
> On Wed, Jul 23, 2008 at 08:29:42AM -0500, Peter Karman wrote:
> > On 07/22/2008 10:37 PM, Matt S Trout wrote:
> > > On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> > >> Also, somewhat apropos, I have a
> > >> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> > >> stuff.  The LDAP modules didn't work for me because they want to bind
> > >> anonymously and retrieve the crypted password, whereas AD just wants
> > >> to authenticate with a bind.
> > >
> > > So, having established this isn't true.
> > >
> > > Could you perhaps instead post a message asking why your config of the
> > > main LDAP store didn't work so we can figure out what configuration
> > > problem you had and document it?
> >
> > likely he is missing a 'binddn' and 'bindpw' config setting. The initial
> > bind() will try anonymously if those are not set. What I usually do for
> > Active Directory is create a user specifically for use with Net::LDAP
> > (and by extension, C::A::Store::LDAP), and then do all my initial binds
> > with that user/pass.
>
> Hmmm. Should there be an alternative option where (if the user DN is
> deterministic from the username) it skips the first part and just
> tries the bind with $generated_dn and $supplied_password (where
> $generated_dn is the result of a subref/sprintf pattern/whatever
> supplied in config) ?

A directory isn't an RDBMS; one should never assume that the naming attribute 
is the same attribute used for the "username". One should avoid generating DNs 
in anything but code that initially provisions the entry.

Regards,
Buchan

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-23 Thread Matt S Trout
On Wed, Jul 23, 2008 at 08:29:42AM -0500, Peter Karman wrote:
> 
> 
> On 07/22/2008 10:37 PM, Matt S Trout wrote:
> > On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> >> Also, somewhat apropos, I have a 
> >> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
> >> stuff.  The LDAP modules didn't work for me because they want to bind 
> >> anonymously and retrieve the crypted password, whereas AD just wants to 
> >> authenticate with a bind.
> > 
> > So, having established this isn't true.
> > 
> > Could you perhaps instead post a message asking why your config of the
> > main LDAP store didn't work so we can figure out what configuration problem
> > you had and document it?
> 
> likely he is missing a 'binddn' and 'bindpw' config setting. The initial 
> bind() will try
> anonymously if those are not set. What I usually do for Active Directory is 
> create a user
> specifically for use with Net::LDAP (and by extension, C::A::Store::LDAP), 
> and then do all
> my initial binds with that user/pass.

Hmmm. Should there be an alternative option where (if the user DN is
deterministic from the username) it skips the first part and just
tries the bind with $generated_dn and $supplied_password (where
$generated_dn is the result of a subref/sprintf pattern/whatever
supplied in config) ?

-- 
  Matt S Trout   Need help with your Catalyst or DBIx::Class project?
   Technical Directorhttp://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/http://www.shadowcat.co.uk/servers/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-23 Thread Wade . Stuart

Bruce J Keeler <[EMAIL PROTECTED]> wrote on 07/23/2008 02:16:16 PM:

> Peter Karman wrote:
> > On 07/22/2008 10:37 PM, Matt S Trout wrote:
> >
> >> On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> >>
> >>> Also, somewhat apropos, I have a
> >>> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> >>> stuff.  The LDAP modules didn't work for me because they want to bind

> >>> anonymously and retrieve the crypted password, whereas AD just wants
to
> >>> authenticate with a bind.
> >>>
> >> So, having established this isn't true.
> >>
> >> Could you perhaps instead post a message asking why your config of the
> >> main LDAP store didn't work so we can figure out what configuration
problem
> >> you had and document it?
> >>
> >
> > likely he is missing a 'binddn' and 'bindpw' config setting. The
> initial bind() will try
> > anonymously if those are not set. What I usually do for Active
> Directory is create a user
> > specifically for use with Net::LDAP (and by extension, C::A::
> Store::LDAP), and then do all
> > my initial binds with that user/pass.
> >
> > 'binddn' and 'bindpw' are fully documented; if the docs can be
> improved, please send a patch.
> >
> >
> I seem to recall trying that, but it's been long enough that I don't
> recall the details of what went wrong.
>
> The other reason I went off in my own direction is that I wanted to pull
> role information from AD groups, and I couldn't see any way of making
> that work with the stock ::LDAP modules.  I will try to make some time
> to revisit this stuff soon.

http://search.cpan.org/~karman/Catalyst-Authentication-Store-LDAP-0.1002
/lib/Catalyst/Authentication/Store/LDAP.pm#use_roles



___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-23 Thread Bruce J Keeler

Peter Karman wrote:

On 07/22/2008 10:37 PM, Matt S Trout wrote:
  

On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:

Also, somewhat apropos, I have a 
C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
stuff.  The LDAP modules didn't work for me because they want to bind 
anonymously and retrieve the crypted password, whereas AD just wants to 
authenticate with a bind.
  

So, having established this isn't true.

Could you perhaps instead post a message asking why your config of the
main LDAP store didn't work so we can figure out what configuration problem
you had and document it?



likely he is missing a 'binddn' and 'bindpw' config setting. The initial bind() 
will try
anonymously if those are not set. What I usually do for Active Directory is 
create a user
specifically for use with Net::LDAP (and by extension, C::A::Store::LDAP), and 
then do all
my initial binds with that user/pass.

'binddn' and 'bindpw' are fully documented; if the docs can be improved, please 
send a patch.

  
I seem to recall trying that, but it's been long enough that I don't 
recall the details of what went wrong.


The other reason I went off in my own direction is that I wanted to pull 
role information from AD groups, and I couldn't see any way of making 
that work with the stock ::LDAP modules.  I will try to make some time 
to revisit this stuff soon.


Bruce

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-23 Thread Wade . Stuart
Peter Karman <[EMAIL PROTECTED]> wrote on 07/23/2008 08:29:42 AM:

>
>
> On 07/22/2008 10:37 PM, Matt S Trout wrote:
> > On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> >> Also, somewhat apropos, I have a
> >> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> >> stuff.  The LDAP modules didn't work for me because they want to bind
> >> anonymously and retrieve the crypted password, whereas AD just wants
to
> >> authenticate with a bind.
> >
> > So, having established this isn't true.
> >
> > Could you perhaps instead post a message asking why your config of the
> > main LDAP store didn't work so we can figure out what configuration
problem
> > you had and document it?
>
> likely he is missing a 'binddn' and 'bindpw' config setting. The
> initial bind() will try
> anonymously if those are not set. What I usually do for Active
> Directory is create a user
> specifically for use with Net::LDAP (and by extension, C::A::Store::
> LDAP), and then do all
> my initial binds with that user/pass.
>
> 'binddn' and 'bindpw' are fully documented; if the docs can be
> improved, please send a patch.
>

Peter,

  From my perspective they are documented too well -- it took me a bit
to figure out how to do _anon_ binds. =)

-Wade


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-23 Thread Peter Karman


On 07/22/2008 10:37 PM, Matt S Trout wrote:
> On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
>> Also, somewhat apropos, I have a 
>> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
>> stuff.  The LDAP modules didn't work for me because they want to bind 
>> anonymously and retrieve the crypted password, whereas AD just wants to 
>> authenticate with a bind.
> 
> So, having established this isn't true.
> 
> Could you perhaps instead post a message asking why your config of the
> main LDAP store didn't work so we can figure out what configuration problem
> you had and document it?

likely he is missing a 'binddn' and 'bindpw' config setting. The initial bind() 
will try
anonymously if those are not set. What I usually do for Active Directory is 
create a user
specifically for use with Net::LDAP (and by extension, C::A::Store::LDAP), and 
then do all
my initial binds with that user/pass.

'binddn' and 'bindpw' are fully documented; if the docs can be improved, please 
send a patch.

-- 
Peter Karman  .  [EMAIL PROTECTED]  .  http://peknet.com/


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-22 Thread Matt S Trout
On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> Also, somewhat apropos, I have a 
> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
> stuff.  The LDAP modules didn't work for me because they want to bind 
> anonymously and retrieve the crypted password, whereas AD just wants to 
> authenticate with a bind.

So, having established this isn't true.

Could you perhaps instead post a message asking why your config of the
main LDAP store didn't work so we can figure out what configuration problem
you had and document it?

Awesome though it is that you wrote a store and credential, I'd rather the
next person wrote one that didn't already exist :)

-- 
  Matt S Trout   Need help with your Catalyst or DBIx::Class project?
   Technical Directorhttp://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/http://www.shadowcat.co.uk/servers/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-22 Thread Wade . Stuart
Matt S Trout <[EMAIL PROTECTED]> wrote on 07/21/2008 04:32:03 PM:
>
> Maybe the search phase failed for the original poster?
>
> I dunno, I was just saying it should probably support both approaches :)
>

Sorry Matt,  my comment was directed twords the OP not you -- I just
piggybacked on your message.  If the search phase failed for him it seems
like it was a config problem or a edge bug (lets find it and fix vs a new
ldap auth module for cat on cpan).  I have used it on a bunch o different
AD schemas (some heavily segmented,  some heavily locked down) with no
issues.  I don't really know of any non vendor ldap auth that grabs the
crypted pass for client side auth instead of binding against the user (what
this app does).



___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-21 Thread Matt S Trout
On Mon, Jul 21, 2008 at 11:48:39AM -0500, [EMAIL PROTECTED] wrote:
> Matt S Trout <[EMAIL PROTECTED]> wrote on 07/19/2008 07:10:28 PM:
> 
> > On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> > > Also, somewhat apropos, I have a
> > > C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> > > stuff.  The LDAP modules didn't work for me because they want to bind
> > > anonymously and retrieve the crypted password, whereas AD just wants to
> 
> > > authenticate with a bind.  My stuff also gets role information from AD
> > > groups.  I've been meaning to get it out on CPAN one of these days, but
> 
> > > it hasn't been a priority; I suppose I can work on it if anyone else
> > > needs it though.
> >
> > Sounds to me like 'auth by bind' versus 'auth by retrieve and check'
> should
> > be an option in the LDAP stuff, not a separate module. Fancy doing up
> > a patch?
> >
> 
> >From the POD It authenticates users in two steps:
> 
> 
> 
> 1) A search of the directory is performed, looking for a user object that
> 
>matches the username you pass.  This is done with the bind credentials
> 
>supplied in the "binddn" and "bindpw" configuration options.
> 
> 
> 
> 2) If that object is found, we then re-bind to the directory as that
> object.
> 
>Assuming this is successful, the user is Authenticated.
> 
> 
> 
> 
> 
> 
> 
> And the actual check password code:
> 
> $self->store->ldap_bind( undef, $self->ldap_entry->dn, $password,
> 
> 'forauth' );
> 
> Notice the rebind.
> 
> So it does not try to "retrieve the crypted password",  it does bind (anon
> or by authorized service account if set in binddn and bindpw) to the ldap
> server, Next it grabs the user's dn from a search on that bind.  Finally to
> authenticate it actually binds to the ldap server as that user's dn.  This
> works well against AD (I use it),  I don't understand what deficiency you
> are trying to fix with your patch.

Maybe the search phase failed for the original poster?

I dunno, I was just saying it should probably support both approaches :)

-- 
  Matt S Trout   Need help with your Catalyst or DBIx::Class project?
   Technical Directorhttp://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/http://www.shadowcat.co.uk/servers/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-21 Thread Wade . Stuart
Matt S Trout <[EMAIL PROTECTED]> wrote on 07/19/2008 07:10:28 PM:

> On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> > Also, somewhat apropos, I have a
> > C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP
> > stuff.  The LDAP modules didn't work for me because they want to bind
> > anonymously and retrieve the crypted password, whereas AD just wants to

> > authenticate with a bind.  My stuff also gets role information from AD
> > groups.  I've been meaning to get it out on CPAN one of these days, but

> > it hasn't been a priority; I suppose I can work on it if anyone else
> > needs it though.
>
> Sounds to me like 'auth by bind' versus 'auth by retrieve and check'
should
> be an option in the LDAP stuff, not a separate module. Fancy doing up
> a patch?
>

>From the POD It authenticates users in two steps:



1) A search of the directory is performed, looking for a user object that

   matches the username you pass.  This is done with the bind credentials

   supplied in the "binddn" and "bindpw" configuration options.



2) If that object is found, we then re-bind to the directory as that
object.

   Assuming this is successful, the user is Authenticated.







And the actual check password code:

$self->store->ldap_bind( undef, $self->ldap_entry->dn, $password,

'forauth' );

Notice the rebind.

So it does not try to "retrieve the crypted password",  it does bind (anon
or by authorized service account if set in binddn and bindpw) to the ldap
server, Next it grabs the user's dn from a search on that bind.  Finally to
authenticate it actually binds to the ldap server as that user's dn.  This
works well against AD (I use it),  I don't understand what deficiency you
are trying to fix with your patch.





___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-07-19 Thread Matt S Trout
On Wed, Jun 25, 2008 at 11:27:13AM -0700, Bruce J Keeler wrote:
> Also, somewhat apropos, I have a 
> C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
> stuff.  The LDAP modules didn't work for me because they want to bind 
> anonymously and retrieve the crypted password, whereas AD just wants to 
> authenticate with a bind.  My stuff also gets role information from AD 
> groups.  I've been meaning to get it out on CPAN one of these days, but 
> it hasn't been a priority; I suppose I can work on it if anyone else 
> needs it though.

Sounds to me like 'auth by bind' versus 'auth by retrieve and check' should
be an option in the LDAP stuff, not a separate module. Fancy doing up
a patch?

-- 
  Matt S Trout   Need help with your Catalyst or DBIx::Class project?
   Technical Directorhttp://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/http://www.shadowcat.co.uk/servers/

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


Re: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-06-25 Thread Bruce J Keeler

Johannes Plunien wrote:

Hi,

there's already C::A::Store::LDAP to authenticate users against LDAP 
servers. This module fetches a user from LDAP and checks his password 
(if you told C::A::Credential::Password password_type => self_check). 
In most of my apps i don't want to fetch the user from LDAP whereas i 
just want to check his password against LDAP. The user, his roles and 
preferences are stored in a database. So i use 
C::A::Store::DBIx::Class to retrieve a user from the store and a 
custom C::A::Credential::LDAP to verify his password.
Maybe this setup is used by someone else too and above all 
C::A::Credential::LDAP is useful?

If that's the case i'll put it on CPAN - what do you think?

Sounds useful.

Also, somewhat apropos, I have a 
C::A::{Store,Credential}::ActiveDirectory  that I based on the LDAP 
stuff.  The LDAP modules didn't work for me because they want to bind 
anonymously and retrieve the crypted password, whereas AD just wants to 
authenticate with a bind.  My stuff also gets role information from AD 
groups.  I've been meaning to get it out on CPAN one of these days, but 
it hasn't been a priority; I suppose I can work on it if anyone else 
needs it though.


Bruce

___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


RE: [Catalyst] Catalyst::Authentication::Credential::LDAP

2008-06-25 Thread Hartmaier Alexander
Hi!

Imho thats very useful!
Some generic plugin or extending C::P::Auth to combine two auth stores, one for 
authentication and one as source for the roles etc. would be great!

-Alex


-Original Message-
From: Johannes Plunien [mailto:[EMAIL PROTECTED]
Sent: Wednesday, June 25, 2008 6:46 AM
To: catalyst@lists.scsys.co.uk
Subject: [Catalyst] Catalyst::Authentication::Credential::LDAP

Hi,

there's already C::A::Store::LDAP to authenticate users against LDAP
servers. This module fetches a user from LDAP and checks his password
(if you told C::A::Credential::Password password_type => self_check).
In most of my apps i don't want to fetch the user from LDAP whereas i
just want to check his password against LDAP. The user, his roles and
preferences are stored in a database. So i use
C::A::Store::DBIx::Class to retrieve a user from the store and a
custom C::A::Credential::LDAP to verify his password.
Maybe this setup is used by someone else too and above all
C::A::Credential::LDAP is useful?
If that's the case i'll put it on CPAN - what do you think?

Thanks for your time,
plu

--
Johannes Plunien | mailto:[EMAIL PROTECTED] | http://www.pqpq.de


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/


*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
T-Systems Austria GesmbH   Rennweg 97-99, 1030 Wien
Handelsgericht Wien, FN 79340b
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*
Notice: This e-mail contains information that is confidential and may be 
privileged.
If you are not the intended recipient, please notify the sender and then
delete this e-mail immediately.
*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*"*


___
List: Catalyst@lists.scsys.co.uk
Listinfo: http://lists.scsys.co.uk/cgi-bin/mailman/listinfo/catalyst
Searchable archive: http://www.mail-archive.com/catalyst@lists.scsys.co.uk/
Dev site: http://dev.catalyst.perl.org/