389-ds-base

#50577 Ticket 50576 - Same proc uid/gid maps to rootdn for ldapi sasl
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base 50576-ldapi-uid-map  into  master

Download 50577.patch

Bug Description: In containers the directory server process may
not start as root, and root may not even be accessible. This means
that some local administration is difficult to achieve. By allowing
the running process id to map to rootdn (directory manager), we have
the same effective security, but ease use of some cli tools.

Fix Description: Allow uid/gid to map to root dn

https://pagure.io/389-ds-base/issue/50576

Author: William Brown william@blackhats.net.au

Review by: ???

 
dirsrv@ldapkdc:/home/william/development> ldapwhoami -H ldapi://%2fdata%2frun%2fslapd-localhost.socket
SASL/EXTERNAL authentication started
SASL username: gidNumber=477+uidNumber=478,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: cn=Directory Manager
dirsrv@ldapkdc:/home/william/development> id
uid=478(dirsrv) gid=477(dirsrv) groups=477(dirsrv)

LGTM

rebased onto 2764740cf0c8ead91f4db6be70ae22604f62e016

rebased onto 295ea07241a48c1c55c6765e4ca51e99c10a98a9

Pull-Request has been merged by firstyear

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3633

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.