> We have just migrated from openldap to fedora, and have realized with
> horror that some authentication clients (for example CAS) are giving the
> OK to users who submit un empty password string.
>
> We have been going slowly mad trying to find how to block this in the
> configuration.
FDS only cares about the bind method when evaluating access control to
data. When only using the external bind interface, AFAIK there is
currently no way to disable anonymous binds from succeeding with FDS.
One could write a pre authentication plugin which, when enabled, would
prevent anonymous binds from succeeding and send the unwilling to
perform back to the client.
BR,
--
mike