--On Wednesday, February 22, 2006 9:08 AM -0500 Frank Swasey <[EMAIL PROTECTED]> wrote:
Good morning, The standard way that I've always told people is: - Bind to the ldap server - Search for the uid provided - Obtain the DN from the search - Attempt to BIND as the DN using the password they provided.
Of course, assuming that the LDAP server is used for authentication can be a bad mistep for any application. Plenty of people use things like a Kerberos KDC for the authentication bit, meaning that users often have authenticated long before getting to any applications. In that case, then the directory is often used for *authorization* using the credentials the user has already obtained (See things like SASL/GSSAPI or SASL/EXTERNAL for LDAP).
One of the most painful things I deal with in applications is ones that want to use their own username/password space. Second to that are applications that want to take a username and bind against an LDAP directory. Too many application developers spend their time re-inventing the wheel over and over again on how to do authentication, when what they need to focus on is the authorization aspects, since most institutions have already have an authorization scheme in place that the application developers simply need to plug into.
--Quanah -- Quanah Gibson-Mount Principal Software Developer ITS/Shared Application Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html --- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
