How to prevent that the LDAP admin user can login?

[Michael Kotowski]

Hello everybody.

I am using CAS 5.1.x, which shall find the user authentication data in LDAP. Therefore, I configured the following settings (in addition to many others):

cas.authn.ldap[0].bindDn=cn=admin,ou=users,dc=mydomain,dc=de
cas.authn.ldap[0].bindCredential=mypassword

Since I also configured the following, it means that "admin" is a valid user that the CAS logs in.

cas.authn.ldap[0].dnFormat=cn=%s,ou=users,dc=mydomain,dc=de

What is the recommended way to store the CAS authentication data in LDAP to prevent that the LDAP admin user can also login into CAS? Should I put all authentication data below a separated LDAP node, for example, ou=users,dc=cas,dc=mydomain,dc=de, so CAS searches CAS users in another location than the LDAP user location?

Thanks for your feedback.
Regards, Michael.

[Ray Bon]

Michael,

You could move your admin user(s) to ou=admin.

Ray

-- 
Ray Bon
Programmer analyst
Development Services, University Systems
2507218831 | CLE 023 | rb...@uvic.ca