Re: Default Security for LDAP

You are right of course, it depends on the code. I thought he meant the
application was doing a simple LDAP lookup, but thinking about it if its on
IIS and the users are in AD I don't know why they would need to do that.
Anthony,
http://www.airdesk.co.uk


"Joe Kaplan" <joseph.e.kaplan@xxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:%23rjPPEM6HHA.1208@xxxxxxxxxxxxxxxxxxxxxxx
That is actually not totally true. It depends on how the client (the IIS
machine in this case) performs the LDAP operation. AD supports LDAP bind
with both plaintext credentials (LDAP simple bind as per LDAP v3 spec) and
using Windows Negotiate authentication which uses Kerberos or NTLM and is
secure by default in that plaintext credentials are not sent on the wire.

Given that they are using IIS, they could be using one of Microsoft's LDAP
API stacks (wldap32, ADSI, .NET, etc.) and thus could have access to
secure authentication via LDAP. However, this is not guaranteed.

As such, whether or not you really need SSL or some other transport layer
security option between the web server and AD depends on the code that
they are executing.

For safety, you might consider implementing SSL on your DCs and asking
these clients to use it, but this is not absolutely required. If you want
more details, please provide more info on the actual code implementation.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Anthony" <anthony.spam@xxxxxxxxxxxxxx> wrote in message
news:ewp829L6HHA.3716@xxxxxxxxxxxxxxxxxxxxxxx
Charles,
Yes, the LDAP request containing the credentials is not encrypted. You
should use LDAPS if you want to encrypt it. You need a certificate on the
DC to do that.
The username and password will also be passed from the browser to the web
server in clear text unless you use SSL. For that, you need a certificate
on the web server. If you use Basic authentication, every request
contains the credentials so you need to SSL everything that requires
authentication. If you use a custom authentication you may be able to SSL
just the authentication exchange, which will reduce your overheads.
Hope that helps,
Anthony,
http://www.airdesk.co.uk




"Charles" <Charles@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:89AE8EA8-F73E-4EDE-AC2C-2A549DBFCAEE@xxxxxxxxxxxxxxxx
Hi:

I have a group in my org that is using a web application that uses IIS.
Users in the domain will be accessing this site and access will be
granted
depending on if they are able to enter credentials successfully (AD
credentials). Under the covers ldap will be used to contact AD to
validate
the credentials of the users.

My question is by default, are the credentials passed as clear text?
Interested in protecting the user's password when it gets entered by the
user
and it gets transmitted to the Web site. And interested in this user's
password when it gets sent from the website to AD via ldap to verify the
credentials.

Will ldap pass the password as clear text? And will the interactions
between the user and the website as far as the password be protected as
well.
Enabling SSL does this just encrypt the password traveling between the
users
workstation and the website and as it travels between the website and
AD?

Thanks,
Charles






.

Relevant Pages

  • Re: LDAP authentication security ?
    ... If the application supports SASL bind with either GSS-SPNEGO or DIGEST authentication, then you can use that directly with AD without needing to secure the channel as those authentication mechanisms are already secure without channel encryption. ... Simple bind is the authentication mechanism in the LDAP V3 spec and is supported by all LDAP directories. ... If you need SSL, AD supports SSL LDAP just fine, assuming you get a certificate for your domain controllers. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.security)
  • RE: Application to Application authentication models....
    ... Application to Application authentication models.... ... > obtain sensitive data such as connection credentials to database systems? ... The very first thing I would focus on is ensuring that the credentials your ... including pulling credentials off of a separate LDAP ...
    (SecProg)
  • Re: How to add an extra password field to an AD?
    ... that the device in question uses a standard LDAP bind to do LDAP ... you can't change how bind authentication works. ... SSL cannot be used here since the protocol being used does not have an SSL ... My concern is not the LDAP traffic between the service server and the LDAP ...
    (microsoft.public.windows.server.active_directory)
  • Re: DirectoryEntry.NativeObject slow with ASP.Net, but fast in exe
    ... Ah, you are using SSL. ... account doesn't have a client certificate available that the server trusts. ... have a schema caching issue that is causing ADSI to download the LDAP schema ... >> Note that the ADSI approach to authentication doesn't really scale well. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: How do I bind to LDAP with a username/password
    ... Authentication against LDAP normally works by attempting to bind with the ... Failure to bind indicates a failure to authenticate. ... The only other way to do it would be to bind with some master credentials ...
    (comp.lang.java.programmer)