[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Disallow ldap operations without start_tls

Michael Ströder wrote:


Simply use LDAPS (on separate port). It was never defined in a standard but most
LDAP-enabled software supports it.


I did ended up doing this. I had an application that didn't support start_tls on an ldap URI, but did support ldaps (or at least I couldn't find a way to get it to issue start_tls).

On 02/15/2016 07:12 PM, Howard Chu wrote:


is a bit of a red herring. The basics of the Bind operation were defined back in the 1980s in X.500. For performance reasons the protocol is designed with a 1 message request -> 1 message response model. The only way to prevent a client from sending credentials in the clear would be to break the Bind request into two message exchanges. Instead of
  "I want to Bind as DN xxx with password yyy" ->
      <- "OK"
you would have had to do something like
  "I want to Bind" ->
      <- "OK send me your credentials"
  "Here's my DN xxx and password yyy" ->
      <- "OK"

Taking twice as many messages would slow down authentication by 2x. Instead of pessimizing the common case the design assumes that competent administrators have set up both the clients and the servers.



Thanks, this makes sense.

Joshua