Net::LD...roxyAuth(3)

💅 NAME 💅

Net::LDAP::Control::ProxyAuth — the LDAPv3 Proxy Authorization control object, bestie. That's it, that's the whole vibe.

(also hi, you're reading the User Contributed Perl Documentation for Net::LD...roxyAuth(3), okurrr 🎀)

---

✨ SYNOPSIS ✨

Like, literally just copy this and you're golden:

use Net::LDAP;
use Net::LDAP::Control::ProxyAuth;

$ldap = Net::LDAP->new( "ldap.mydomain.eg" );

$auth = Net::LDAP::Control::ProxyAuth->new( authzID => 'dn:cn=me,ou=people,o=myorg.com' );

@args = ( base     => "cn=subnets,cn=sites,cn=configuration,$BASE_DN",
          scope    => "subtree",
          filter   => "(objectClass=subnet)",
          callback => \&process_entry, # Call this sub for each entry
          control  => [ $auth ],
);

while (1) {
  # Perform search
  my $mesg = $ldap->search( @args );

  # Only continue on LDAP_SUCCESS
  $mesg->code and last;

}

No cap, that while (1) loop is a whole mood — it just keeps searching until $mesg->code says "nope, we're done." 🦋

---

🌸 DESCRIPTION 🌸

So "Net::LDAP::Control::ProxyAuth" is the whole interface for creating and manipulating objects that represent the "Proxy Authorization Control" — and yes, that's exactly as described by RFC 4370. Iconic of them honestly.

It lets a client be bound to an LDAP server with its own identity... but then go perform operations on behalf of another user, the "authzID". It's giving "main character energy" but for someone else. Lowkey the whole point. 💅

Here's the tea: with the exception of any extension that causes a change in authentication, authorization or data confidentiality, a single "Proxy Authorization Control" may be included in any search, compare, modify, add, delete, or moddn or extended operation. Pretty much every op, bestie. Slay. ✨

And as required by the RFC, the criticality of this control is automatically set to TRUE — which protects clients from submitting requests with other identities than they intend to. So it's not being extra, it's being safe. 🫶

---

🎀 CONSTRUCTOR ARGUMENTS 🎀

So besides the constructor arguments described in Net::LDAP::Control, you also get these:

• authzID — the authzID that is required. This is the identity we are requesting operations to use. That's the one you want, fr fr.
• proxyDN — okay so in early versions of the drafts to RFC 4370, draft-weltman-ldapv3-proxy-XX.txt, the value in the control (and thus the constructor argument) was a DN and was called "proxyDN". It served the same purpose as "authzID" in recent versions of the "proxyAuthorization" control. Same energy, different era. 🙈

Please note: unfortunately the OID and the encoding or the "Proxy Authorization Control" changed significantly between early versions of draft-weltman-ldapv3-proxy-XX.txt and the final RFC. Not ideal, but here we are 😭

Net::LDAP::Control::ProxyAuth tries to cope with that situation and changes the OID and encoding used depending on the constructor argument. So:

• with "proxyDN" as constructor argument → the old OID and encoding are used
• with "authzID" as constructor argument → the new OID and encoding are used

Using this logic, servers supporting either OID can be handled correctly. It's giving "why not both" and honestly? It ate. 🔥

---

⭐ METHODS ⭐

As with Net::LDAP::Control, each constructor argument described above is also available as a method on the object — and it's a real one-brain-cell-two-jobs situation:

• call it without an argument → it returns the current value for the attribute
• call it with an argument → it sets a new value for the attribute

That's it. That's the method. 👑

---

🦋 SEE ALSO 🦋

• Net::LDAP
• Net::LDAP::Control

Go read those too, iykyk 💜

---

🌈 AUTHORS 🌈

Olivier Dubois, Swift sa/nv — based on Net::LDAP::Control::Page from Graham Barr <gbarr@pobox.com>.

Peter Marschall <peter@adpm.de> added authzID extensions based on ideas from Graham Barr <gbarr@pobox.com>. The way they built on each other's work... collaboration icon behavior 🫶

Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>. They want to hear from you, bestie. Don't be shy. 💌

---

💖 COPYRIGHT 💖

Copyright (c) 2001-2004 Graham Barr. All rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

---

and that's the whole page, bestie 🎀✨🦋 — this cutie was baked into perl v5.42.0, dated 2024-01-02, and it's the Net::LD...roxyAuth(3) page on the way out. mwah 💋 💜