Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use an ldap to control with a proxy the internet access. But I've got a problem, when I disable user, they still have access to internet, and when I enable them again, they do not have access this time, the only way to let them use the net again is to modify their passwd... I was wondering why my ldap act like this... Maybe because of some update? I don't know.

If you have any idea, you're welcome!

share|improve this question
2  
You'll get better answers if you give details of your ldap implementation and which proxy you are using. –  dunxd Oct 21 '10 at 7:20
add comment

3 Answers

I know the problem, you have to reload the squid service for the modification to be take into account.

By the way the best way to prevent user to connect to the internet is to block them on your proxy. For exemple with squid, you just create an blocked_user.acl, and you put the uid off the user in the file, reload squid, and enjoy the result.

share|improve this answer
add comment

Authentication should occur with kerberos or some other authentication server. LDAP is just a directory.

So what comes to mind is;

  • replication problem
  • replication delay

So obviously check your logs. Make them more verbose if possible.

To solve the authentication server should attempt to contact the ldap at some point during the process; use wireshark or something to do some packet analysis.

share|improve this answer
    
Actually authentication can occur over many different methods. Kerb is just one. The LDAP server could be passing through bind attempts and returning success or failure. Could be doing a compare of userPassword... –  geoffc Oct 22 '10 at 0:53
add comment

You need to provide more details on what LDAP backend server, what Proxy application you are using.

however it seems most likely to me that you are seeing a caching issue.

The change to the user Disabled status is cached, and only a password change is being refreshed. Predictably, since passwords are probably never cached, each login attempt forces a connection to bind and test the password, and if it fails, then it probably looks at the rest of the object to decide why which would re-read the disabled state.

Drop the LDAP cache time to live in your proxy perhaps?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.