Lightweight Directory Access Protocol (LDAP) Proxied Authorization Control
Extracted elements (14)
Fine-grained access control systems may grant proxy rights at the top of a search tree but not at or below certain points within the tree, illustrating why per-entry evaluation of proxy rights is necessary.
The mechanism for determining proxy access rights is specific to the server's proxy authorization policy, allowing flexibility in how servers implement and enforce proxy authorization decisions.
During evaluation of a search request, entries that would be returned for the proxy authorization identity directly may not be returned if the requester lacks the right to assume the requested identity for searching that entry, even if the entry is within the search scope. This may result in fewer or no results compared to a direct request.
A single Proxy Authorization Control may be included in any search, compare, modify, add, delete, modify DN, or extended operation request. It MUST NOT be used with extensions that cause changes in authentication, authorization, or data confidentiality, such as Start TLS.
Servers MUST reject any request containing a Proxy Authorization Control without a criticality flag or with the flag set to FALSE with a protocolError error, to protect clients from submitting requests executed with an unintended authorization identity.
Support for the Proxy Authorization Control is indicated by the presence of the OID '2.16.840.1.113730.3.4.18' in the supportedControl attribute of a server's root DSE.
The controlValue SHALL be present and SHALL either contain an authzId representing the authorization identity for the request or be empty if an anonymous association is to be used.
The criticality flag MUST be present and MUST be set to TRUE. Clients MUST include the criticality flag and set it to TRUE to protect against unintended authorization identity use.
If the requested authorization identity is recognized and the client is authorized to adopt it, the request is executed as if submitted by the proxy authorization identity; otherwise, result code 123 is returned.
The Proxy Authorization Control allows a client to request that an LDAP operation be processed under a provided authorization identity instead of the current authorization identity associated with the connection. It applies on a per-operation basis, benefiting clients performing operations on behalf of multiple users.
The OID '2.16.840.1.113730.3.4.18' is reserved and registered for the Proxy Authorization Control as an LDAP Protocol Mechanism per RFC 3383. A result code (123) has been assigned by IANA for the case where the server does not execute a request using the proxy authorization identity.
The Proxy Authorization Control may be passed over both secure and insecure channels. The control allows an additional authorization identity to be passed, which may contain confidential information requiring privacy protection.
The server is responsible for determining if a proxy authorization request is to be honored. 'Anonymous' users SHOULD NOT be allowed to assume the identity of others.
The controlType field of the Proxy Authorization Control is the OID '2.16.840.1.113730.3.4.18'. The criticality field MUST be present and MUST be TRUE. The controlValue SHALL be present and SHALL contain an authzId or be empty for anonymous association.