[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: storing ldap passwords on HSM



Michael Ströder wrote:
Howard Chu wrote:
Given that Cyrus-SASL has a listmechs() API, I don't see why a client would
ever have a hardcoded list of supported mechanisms.

Please re-read in my posting:
"At a minimum you have to register a new SASL mech as
being a password-based mech."

The SASL library provides its own prompts as well. ldap_sasl_interactive_bind works without knowing anything about the mechanism in advance.

Be assured that I really know what I'm talking about:
An interactive UI needs some extra effort.

You aren't the first or only person to have wrapped a GUI around a SASL authentication.

https://git.gnome.org/browse/ekiga/tree/plugins/ldap/ldap-book.cpp

If your application requires updates every time a new loadable plugin is released for one of its underlying libraries, you're just making things harder on yourself.

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/