« Return to Thread: ldap authentication
Quanah Gibson-Mount wrote:
--On Wednesday, February 22, 2006 9:08 AM -0500 Frank Swasey
<Frank.Swasey@uvm.edu> wrote:
> Good morning,
>
> The standard way that I've always told people is:
>
> - Bind to the ldap server
> - Search for the uid provided
> - Obtain the DN from the search
> - Attempt to BIND as the DN using the password they provided.
Of course, assuming that the LDAP server is used for authentication can be
a bad mistep for any application. Plenty of people use things like a
Kerberos KDC for the authentication bit, meaning that users often have
authenticated long before getting to any applications. In that case, then
the directory is often used for *authorization* using the credentials the
user has already obtained (See things like SASL/GSSAPI or SASL/EXTERNAL for
LDAP).
One of the most painful things I deal with in applications is ones that
want to use their own username/password space. Second to that are
applications that want to take a username and bind against an LDAP
directory. Too many application developers spend their time re-inventing
the wheel over and over again on how to do authentication, when what they
need to focus on is the authorization aspects, since most institutions have
already have an authorization scheme in place that the application
developers simply need to plug into.
--Quanah
--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html
---
You are currently subscribed to ldap@umich.edu as: [lists@nabble.com]
To unsubscribe send email to ldap-request@umich.edu with the word UNSUBSCRIBE as the SUBJECT of the message.
« Return to Thread: ldap authentication
| Free Forum Powered by Nabble | Forum Help |