Scenario: I need to publish internal Active Directory to SaaS platforms over public Internet. I'm going to use OpenLDAP to filter access. Access to OpenLDAP will be limited by firewall IP whitelist.

I've managed to configure OpenLDAP to only allow access to required objects (groups and accounts required to SaaS platform, only required attributes).

However I cannot figure out, if I can limit which account can authenticate to proxy. So far any account in Active Directory can bind. I don't fully trust the SaaS platforms and I'd like to limit possible password guess attacks via SaaS platforms. I've tried following syntax, but still anyone can bind:

access to dn.exact="objectDN"
  by * auth

access to *
  by * none

Is there a way to limit accounts allowed to authenticate?

  • Are we talking about the SAAS solutions connecting to the OpenLDAP to query user info? Are the SAAS solutions authenticating as specific users to do the bind? Anonymous bind is disabled?
    – LeeM
    Apr 5, 2019 at 4:24
  • Yes, it connects to OpenLDAP to query user info (that is retrieved from backend Active Directory). SaaS solutions have specific service accounts for binding. Anonymous bind is disabled.
    – Don Zoomik
    Apr 7, 2019 at 11:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy