Restricting LDAP permissions

[davidfraser]

I want to enable people to use LDAP to access their contacts from mail clients.
I would prefer if this information were not made public though... so I want to require authentication.

But Zimbra seems to use LDAP internally without authentication, and adding "require authc" to slapd.conf seems to stop mail sending etc from working

LDAP Security ? suggests blocking access to LDAP with the firewall but then people can't use it externally at all

Is there any way to configure openldap to do this or should I be filing something in bugzilla?

[quanah]

A bug for this already exists:

Bug 15378 - Obviate the need for and disallow LDAP anonymous binds

It is not currently resolved. You can with 5.0.0 and up work on disabling anonymous access to most things by manually customizing the ACLs. I think what you are really trying to do is also tied in with:

Bug 16601 - Secure Access To LDAP

So you have secure connections without anonymous binds.

[davidfraser]

Yay, voted for the bugs and waiting for the switch to make it into the 5.0 series - will be much easier than trying to patch all the LDAP config myself. Thanks for the feedback...