[Catalyst] passwordless LDAP authentication

[Andrew Rodland]

On Monday 27 July 2009 04:38:35 am Rodrigo wrote:
> Hi all,
> I'm using Catalyst::Authentication::Store::LDAP to authenticate users, but
> now I need to allow some of them to single-signon without a password, like
> this:
> [...]
> > I'm looking at the authentication internals and it seems to be missing a
> per-user flag to disable password checking. Only a global realm-based
> password_type=>'none' exists. Am I correct?
>
That's not auth in general, it's Credential::Password. You can write your own 
credential that implements your own policy and have it do whatever you like.

> To make matters worse, LDAP::User::check_password also checks user roles
> since it needs the password to bind to the ldap server. That could make it
> more difficult to implement a passwordless flag at any level on the
> authenticate chain.
>
Store::LDAP has an option for whether or not to rebind as the given user when 
doing role searches. If it's off, and if your LDAP permissions are set 
appropriately, you shouldn't need the user's password at any phase.

Andrew