Re: FW: isakmpd AND NOT policy

["Angelos D. Keromytis" <angelos@cs.columbia.edu>]

In message <D58D3E1961C58043BD828065D12E49951D6D05@foxserver>, Pepijn Vissers w
rites:
>
>142342.263902 Plcy 40 check_policy: adding authorizer [DN:/L=Den
>Haag/C=NL/OU=Roaming User 001<snip>
>
>Normally, because this user has a CA-signed PGPkey, he would be able to
>connect, because
>all CA-signed certificates are authorized by "POLICY". I now want to exclude
>users that 
>still have their CA-signed key, but should no longer be allowed to connect,
>by matching
>their DN to a 'blacklist'.

Ah, ok. Yes, you can match against _ACTION_AUTHORIZERS (sorry, _AUTHORIZERS by
itself is not right), but note that this user can delegate to another (fake)
user and bypass the check, unless you've set the no-propagate (no-delegate) flag
in their X.509 certificate.
-Angelos