[FW-1] Details of LDAP groups

[Hadmut Danisch <hadmut@FW1-NOSPAMDANISCH.DE>]

Hi,

I have a problem with the differences between NG-FP3 and NG-FP4:


There is an LDAP server (tested both openldap and NDS),
without Checkpoint schema, just keeping users and groups of
users.

And there are two machines freshly setup for debugging, one
with FP3 and one with FP4.

LDAP server is setup as an LDAP account server, and an LDAP
user group is based on it and linked to a user group in the
LDAP server.


Now a user logs in at the firewalll (session auth, telnet fw 259, but
that doesn't really matter).



Both FP3 and FP4

- Bind to the LDAP server with their own identity and password.

- Find the user

- Check whether the user is of type fw1user (is not, but that's not
  a problem)

- Check whether the user is a member of the given group.

Everything ok until here.


Now the password verification:

There is no radius server, no tacacs, no kerberos, no
userPassword entry.

FP4 verifies the password by simply binding to the LDAP
server with the user's DN and the given password. If the
LDAP server accepts the password, the user is authorized.

FP3 simply does nothing and tells password is wrong.


Is there a way to have the FP3 checked the password the same
way?

Hadmut

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================