LDAP auth without Bind DN

[StFS]

Hi.

First of all, I want to note that I'm not an expert on LDAP so things I say may very well be wrong. Just point that out to me if that's the case.

As I understand LDAP (and although I'm not an expert I have set up systems that authenticate against it), I don't really understand why there should be a specific Bind DN and password.

As far as I gather, some of the systems I've set up have actually just used the username and password of the user trying to log in as their Bind authentication. If the binding is successful, further checks may be made but if it's unsuccessful, the login for that user fails.

I don't see this as an option for Zabbix. Can anyone comment on this? Is doing this a bad idea for some reason? Can it be done in Zabbix?

Kind regards, Stefan Freyr.

[fjrial]

imho, I think that a better approach is setting, first a user with binding permission, and then do login with a ldap user.. and zabbix (and almost every app that I may know) works in this way..

This avoids the risk of a lot of unwanted apps (avoid cpu load in ldap server) logging against the ldap without the permission of the ldap administrator..

Cheers.

[Zaniwoop]

I have always setup a user (called LDAP :p) on every system where LDAP will be used, purely for this purpose.

The user itself has no rights to do anything, other than lookup LDAP.