> 'mod_auth_ldap', and 'xdb_ldap'. Of these, only 'mod_auth_ldap' appears to
> be actively developed, and all three have scalability issues.
What scalability issues? I'm sure I could think of a couple (the auth
module blocking its single thread being the most obvious), but you sound
like you've done a bit more investigation into this than I have. If you
have any suggestions as to how to improve the module, I'd like to hear
it :)
> OTOH, while 'mod_auth_ldap' never retrieves the user's plaintext password
> from the server, and works without priviledged access to the LDAP server,
> it only supports Jabber's password (no Digest, no 0K) authentication, where
> the client sends their password in the clear. This isn't so bad if you can
> ensure that your clients always use SSL to connect to the server.
Though _any_ not-SSL LDAP client suffers from this problem. I beleive
someone has a patch in the works to SSL-enable mod_auth_ldap. The LDAP
administrator at my organisation has a project underway to make
LDAP-over-SSL available. Once this exists, I will probably look at
adding SSL support to the module, which should fix the Jabber server <->
LDAP server side, at least.
Though there's still the plaintext password being handed from the Jabber
client to the server, which unfortunately, isn't quite so easy to fix.
Regards,
Rob.
--
Robert Norris <[EMAIL PROTECTED]>
1024D/FC18E6C2 6FBF 098A A3F2 A728 490F 7743 59BD 7767 FC18 E6C2
PGP signature
