14.14 Proxied Authorization Control

OpenText eDirectory provides the flexibility of controlling proxied authorization through the LDAP protocol as specified in RFC 4370. The proxied authorization control allows a client to request that an operation be processed with a provided authorization identity instead of the current authorization identity associated with the connection. This feature provides a mechanism for specifying an authorization identity for each operation, which benefits the clients that need to perform several operations on behalf of multiple users.

To authenticate with the OpenText eDirectory server, an administrator must provide the proxied authorization control OID 2.16.840.1.113730.3.4.18 in the client request. To use the proxied authorization control, the authenticated user should have supervisor rights on the impersonated user.

  1. Create an OpenText eDirectory tree and add user objects to it.

  2. On OpenText Identity Console home page, click Rights Management tile.

  3. Click Trustees.

  4. Click Search Object and select user from the list.

  5. On the Context Browser screen > select the User > click OK.

  6. Click Assigned Rights > select the assigned rights for the selected user. Example: read, write, or nested.

  7. Click Done, then click Apply.

To perform proxied authorization for ldapsearch, use the following command:

ldapsearch -x -H ldap://[ldap host ip]:[ldap-port] -D <Admin DN> -w <Password> -e '!authzid=dn:<Impersonate user> -b o=novell -s one

To perform other LDAP operations using proxied authorization control, provide 2.16.840.1.113730.3.4.18 OID in the LDAP request.

Auditing the Proxied Authorization Operations

To audit the proxied authorization operations, OpenText eDirectory provides a new event called DSE_IMPERSONATE.