qazmlp writes: > I need an LDAP authentication mechanism with which only the 'password' > used in the LDAP Bind request, is sent in the encrypted format. > All the other data in the Bind request and also the other LDAP requests > and responses(add, search etc.) can be sent in a simple/unencrypted way. > > Which mechanism I should go ahead with? > - Simple auth. does not help, as it requires the password sent in plain > ASCII format.
Right. > - SSL auth. does not help, as it en/decrypts all the data that is sent > over the LDAP connection, which causes slight performance overhead. Unless your implementation supports re-negotiating the TLS cipher down to null cipher after Bind. But is this slight performance overhead a problem for you? Or are you solving a non-problem here, so you could just as well accept encryption of the entire session? > - SASL auth. also does not help. (I'm not sure here!) Yes it does. The DIGEST-MD5 mechanism for example. It supports a security layer (just like TLS), but that's optional. -- Regards, Hallvard --- You are currently subscribed to [email protected] as: [EMAIL PROTECTED] To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the SUBJECT of the message.
