NAME

       Net::LDAP::Control::ProxyAuth - LDAPv3 Proxy Authorization control object

SYNOPSIS

        use Net::LDAP;
        use Net::LDAP::Control::ProxyAuth;

        $ldap = Net::LDAP->new( "ldap.mydomain.eg" );

        $auth = Net::LDAP::Control::ProxyAuth->new( authzID => 'dn:cn=me,ou=people,o=myorg.com' );

        @args = ( base     => "cn=subnets,cn=sites,cn=configuration,$BASE_DN",
                  scope    => "subtree",
                  filter   => "(objectClass=subnet)",
                  callback => \&process_entry, # Call this sub for each entry
                  control  => [ $auth ],
        );

        while (1) {
          # Perform search
          my $mesg = $ldap->search( @args );

          # Only continue on LDAP_SUCCESS
          $mesg->code and last;

        }

DESCRIPTION

       "Net::LDAP::Control::ProxyAuth" provides an interface for the creation and manipulation of objects that
       represent the "Proxy Authorization Control" as described by RFC 4370.

       It allows a client to be bound to an LDAP server with its own identity, but to perform operations on
       behalf of another user, the "authzID".

       With the exception of any extension that causes a change in authentication, authorization or data
       confidentiality, a single "Proxy Authorization Control" may be included in any search, compare, modify,
       add, delete, or moddn or extended operation.

       As required by the RFC, the criticality of this control is automatically set to TRUE in order to protect
       clients from submitting requests with other identities than they intend to.

CONSTRUCTOR ARGUMENTS

       In addition to the constructor arguments described in Net::LDAP::Control the following are provided.

       authzID
           The authzID that is required. This is the identity we are requesting operations to use.

       proxyDN
           In  early  versions  of  the  drafts to RFC 4370, draft-weltman-ldapv3-proxy-XX.txt, the value in the
           control and thus the constructor argument was a DN and was called  "proxyDN".   It  served  the  same
           purpose as "authzID" in recent versions of "proxyAuthorization" control.

       Please  note:  Unfortunately  the  OID  and  the  encoding  or  the "Proxy Authorization Control" changed
       significantly  between  early  versions  of  draft-weltman-ldapv3-proxy-XX.txt   and   the   final   RFC.
       Net::LDAP::Control::ProxyAuth  tries  to  cope  with that situation and changes the OID and encoding used
       depending on the constructor argument.

       With "proxyDN" as constructor argument the old OID  and  encoding  are  used,  while  with  "authzID"  as
       constructor  argument  the new OID and encoding are used.  Using this logic servers supporting either OID
       can be handled correctly.

METHODS

       As with Net::LDAP::Control each constructor argument described above is also available as a method on the
       object which will return the current value for the attribute if called without an argument, and set a new
       value for the attribute if called with an argument.

SEE ALSO

       Net::LDAP, Net::LDAP::Control,

AUTHORS

       Olivier Dubois, Swift sa/nv based on Net::LDAP::Control::Page from Graham Barr <gbarr@pobox.com>.   Peter
       Marschall <peter@adpm.de> added authzID extensions based on ideas from Graham Barr <gbarr@pobox.com>.

       Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>

COPYRIGHT

       Copyright  (c)  2001-2004  Graham  Barr.  All  rights  reserved.  This  program is free software; you can
       redistribute it and/or modify it under the same terms as Perl itself.

perl v5.32.0                                       2021-01-03                 Net::LDAP::Control::ProxyAuth(3pm)