Wallet...ribute(3pm)

📦 version 1.7, in debian trixie, ubuntu resolute, ubuntu stonking

💖 Wallet::ACL::LDAP::Attribute — the manual, but make it cute 💖

okay bestie, so this is Wallet::ACL::LDAP::Attribute from the User Contributed Perl Documentation, section 3pm. she's a Perl module, she's part of the wallet system, and she is lowkey the bouncer at the LDAP club. let's get into it 💅

✨ NAME ✨

Wallet::ACL::LDAP::Attribute — the Wallet ACL verifier that does LDAP attribute compares. no cap, that's literally her whole job 🎀

🌸 SYNOPSIS 🌸

my $verifier = Wallet::ACL::LDAP::Attribute->new;
my $status = $verifier->check ($principal, "$attr=$value");
if (not defined $status) {
    die "Something failed: ", $verifier->error, "\n";
} elsif ($status) {
    print "Access granted\n";
} else {
    print "Access denied\n";
}

🦋 DESCRIPTION 🦋

so here's the vibe. Wallet::ACL::LDAP::Attribute checks whether the LDAP record for the entry that corresponds to a principal contains an attribute with a particular value. that's it, that's the whole personality.

she's the one you call to verify ACL lines of type ldap-attr. and the value of one of those ACLs? it's a valid LDAP filter. the ACL grants access to a given principal if and only if an LDAP search — using a filter built out of the principal filter AND the ACL filter — comes back with a single entry. one entry. not zero, not two. one. periodt 👑

not me stressing that it has to be exactly one entry. that part is not a suggestion bestie, it's the rule.

to actually use this object, a bunch of configuration parameters have to be set first. go read Wallet::Config for the deets on those parameters and for info on how to set wallet configuration. iykyk 💜

🎀 METHODS 🎀

  • new() — creates a brand new ACL verifier. she opens the connection to the LDAP server and binds it. like, she's not just saying hi, she's fully introducing herself ✨
  • check(PRINCIPAL, ACL) — returns true if PRINCIPAL is granted access according to ACL, false if not, and undef on an error (peep "DIAGNOSTICS" below). ACL must be a valid LDAP filter. and the filter formed using the PRINCIPAL plus the ACL filter must return a single entry for access to be granted. one. entry. 🫶
  • error() — returns the error if check() came back undef. your emotional support error message 💖

😭 DIAGNOSTICS 😭

the new() method may fail with one of these exceptions, and bestie, if you see one of these, that's your sign:

  • LDAP attribute ACL support not available: %s — trying to connect to or bind to the LDAP server? it failed. tragic. 💀
  • LDAP attribute ACL support not configured — the required configuration parameters weren't set. go look at Wallet::Config(3) for which configuration parameters are required and how to set them 🙈

verifying an LDAP attribute ACL may fail with the following errors (these ones come back from the error() method):

  • search for %s failed in LDAP: %s — the search for an ldap entry failed because of a configuration error in Wallet or in the LDAP server. for example, the Wallet configuration includes an invalid root DN 😬
  • malformed ldap-attr LDAP filter, no equal sign present — the ACL filter stored as ldap-attr is not a valid LDAP filter. where's the = bestie 😭
  • malformed ldap-attr LDAP filter, parenthesis mismatch — the ACL filter stored as ldap-attr is not a valid LDAP filter. the parentheses are not parenthesising 🍓
  • mapping principal to LDAP failed: %s — there was an ldap_map_principal() function defined in the wallet configuration, but calling it for the PRINCIPAL argument failed 💔
  • no ACL specified — the ACL parameter passed to check() was undefined or the empty string. she needs something to work with 🧚
  • no principal specified — the PRINCIPAL parameter passed to check() was undefined or the empty string. same energy, different argument 🌸

🔥 SEE ALSO 🔥

this module is part of the wallet system. the current version is available from <https://www.eyrie.org/~eagle/software/wallet/>. go get her 🌈

👑 AUTHOR 👑

Russ Allbery <eagle@eyrie.org> — the icon who wrote this. we stan 🫶

and that's the whole page, bestie!! this came to you courtesy of perl v5.40.0, dated 2024-11-12 — yeah she's been around, she's got seniority, she's still slaying 💖✨🎀🦋

📦 where this page comes from