Scenario: I need to publish internal Active Directory to SaaS platforms over public Internet. I'm going to use OpenLDAP to filter access. Access to OpenLDAP will be limited by firewall IP whitelist.
I've managed to configure OpenLDAP to only allow access to required objects (groups and accounts required to SaaS platform, only required attributes).
However I cannot figure out, if I can limit which account can authenticate to proxy. So far any account in Active Directory can bind. I don't fully trust the SaaS platforms and I'd like to limit possible password guess attacks via SaaS platforms. I've tried following syntax, but still anyone can bind:
access to dn.exact="objectDN" by * auth access to * by * none
Is there a way to limit accounts allowed to authenticate?