LDAP prohibits anonymous access

LDAP defaults to allow users to access anonymously, such as: When using the tool connection, check the anonymous binding, do not need to enter USERDN and password may be connected to the LDAP server, but only read and search operations. No modifications or deletions can be made.

Methods for prohibiting anonymous access:

1. Delete Anonymous access control commands

2. Modify the Anonymous access control directive (modify anyone to all)

====================================================================

Define user access-USERDN keyword

Use the userdn keyword to define user access. The userdn keyword requires one or more valid distinguished names and takes the following format:

UserDN = "ldap:///dn [| | ldap:///DN] ... [|| ldap:///DN] "

Where theDN can be either a DN or a anyone, all, a self, or one of the parent expressions. These expressions apply to the following users:

• UserDN = "Ldap:///anyone"-Applies to both anonymous users and authenticated users.

• UserDN = "Ldap:///all"-Applies only to authenticated users.

• UserDN = "Ldap:///self"-Applies only to users who are the same as the ACI target entry.

• UserDN = "Ldap:///parent"-Applies only to the parent entry of the ACI target.

The USERDN keyword can also be represented as an LDAP filter in the following form

ldap:///suffix?? Sub? (filter) If the DN contains commas, the comma must precede the backslash (\) escape character.

Anonymous access (anyone keyword)

Granting anonymous access to a directory means that no one can access it without providing a binding DN or password, and regardless of the binding situation. Anonymous access can be limited to specific types of access (for example, read access or search access), specific subtrees in the directory, or individual entries. Anonymous access using the Anyone keyword also allows access to all authenticated users.

General access (all keywords)

You can use binding rules to indicate permissions that apply to anyone who has successfully bound to a directory. Therefore, theall keyword allows access to all authenticated users. This will allow for general access while preventing anonymous access.

Auto-access (self keyword)

Specifies that users are allowed or denied access to their own entries. In this case, if the binding DN matches the DN of the target entry, access is allowed or denied.

Parental access (parent keyword)

Specifies that the user is allowed or denied access to this article only if the user's binding DN is the parent of the target entry. Note that ACI must be manually edited in the Server Console to use the parent keyword.

LDAP URL

You can use a URL with a filter to target users in ACI dynamically, as follows:

UserDN = "LDAP:///<SUFFIX>?? Sub? (filter) "

For example, all users in the accounting and engineering branches of the example.com tree will be allowed or denied access based on the following URLs:

UserDN = "ldap:///dc=example,dc=com??" Sub? (| (ou=engineering) (ou=accounting)) "

Do not specify a host name or port number within the LDAP URL. The LDAP URL is always applied to the local server.

Reference: http://docs.oracle.com/cd/E19957-01/816-6852-10/aci.html#71361

LDAP prohibits anonymous access