.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Net::LDAP::Control::ProxyAuth 3"
.TH Net::LDAP::Control::ProxyAuth 3 2023-07-26 "perl v5.38.0" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
Net::LDAP::Control::ProxyAuth \- LDAPv3 Proxy Authorization control object
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 2
\& use Net::LDAP;
\& use Net::LDAP::Control::ProxyAuth;
\&
\& $ldap = Net::LDAP\->new( "ldap.mydomain.eg" );
\&
\& $auth = Net::LDAP::Control::ProxyAuth\->new( authzID => \*(Aqdn:cn=me,ou=people,o=myorg.com\*(Aq );
\&
\& @args = ( base     => "cn=subnets,cn=sites,cn=configuration,$BASE_DN",
\&           scope    => "subtree",
\&           filter   => "(objectClass=subnet)",
\&           callback => \e&process_entry, # Call this sub for each entry
\&           control  => [ $auth ],
\& );
\&
\& while (1) {
\&   # Perform search
\&   my $mesg = $ldap\->search( @args );
\&
\&   # Only continue on LDAP_SUCCESS
\&   $mesg\->code and last;
\&
\& }
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
\&\f(CW\*(C`Net::LDAP::Control::ProxyAuth\*(C'\fR provides an interface for the creation and manipulation
of objects that represent the \f(CW\*(C`Proxy Authorization Control\*(C'\fR as described by RFC 4370.
.PP
It allows a client to be bound to an LDAP server with its own identity, but to perform
operations on behalf of another user, the \f(CW\*(C`authzID\*(C'\fR.
.PP
With the exception of any extension that causes a change in authentication,
authorization or data confidentiality, a single \f(CW\*(C`Proxy Authorization Control\*(C'\fR
may be included in any search, compare, modify, add, delete, or moddn or
extended operation.
.PP
As required by the RFC, the criticality of this control is automatically set to
TRUE in order to protect clients from submitting requests with other identities
than they intend to.
.SH "CONSTRUCTOR ARGUMENTS"
.IX Header "CONSTRUCTOR ARGUMENTS"
In addition to the constructor arguments described in
Net::LDAP::Control the following are provided.
.IP authzID 4
.IX Item "authzID"
The authzID that is required. This is the identity we are requesting operations to use.
.IP proxyDN 4
.IX Item "proxyDN"
In early versions of the drafts to RFC 4370, draft\-weltman\-ldapv3\-proxy\-XX.txt,
the value in the control and thus the constructor argument was a DN and was called \f(CW\*(C`proxyDN\*(C'\fR.
It served the same purpose as \f(CW\*(C`authzID\*(C'\fR in recent versions of \f(CW\*(C`proxyAuthorization\*(C'\fR control.
.PP
\&\fBPlease note:\fR
Unfortunately the OID and the encoding or the \f(CW\*(C`Proxy Authorization Control\*(C'\fR
changed significantly between early versions of draft\-weltman\-ldapv3\-proxy\-XX.txt
and the final RFC.
Net::LDAP::Control::ProxyAuth tries to cope with that situation and changes
the OID and encoding used depending on the constructor argument.
.PP
With \f(CW\*(C`proxyDN\*(C'\fR as constructor argument the old OID and encoding are used,
while with \f(CW\*(C`authzID\*(C'\fR as constructor argument the new OID and encoding are used.
Using this logic servers supporting either OID can be handled correctly.
.SH METHODS
.IX Header "METHODS"
As with Net::LDAP::Control each constructor argument
described above is also available as a method on the object which will
return the current value for the attribute if called without an argument,
and set a new value for the attribute if called with an argument.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Net::LDAP,
Net::LDAP::Control,
.SH AUTHORS
.IX Header "AUTHORS"
Olivier Dubois, Swift sa/nv based on Net::LDAP::Control::Page from
Graham Barr <gbarr@pobox.com>.
Peter Marschall <peter@adpm.de> added authzID extensions
based on ideas from Graham Barr <gbarr@pobox.com>.
.PP
Please report any bugs, or post any suggestions, to the perl-ldap
mailing list <perl\-ldap@perl.org>
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (c) 2001\-2004 Graham Barr. All rights reserved. This program is
free software; you can redistribute it and/or modify it under the same
terms as Perl itself.