Thanks very much, Stig, very helpful! We are just scouting the technology
right now, so my more precise questions will come later ;) We will be using
SSL. Given that, it looks to me like decision maker mode is the way to go?
Kirk
-Original Message-
From: Stig Venaas [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, October 31, 2001 3:06 AM
To: Johnson, Kirk
Cc: PHP General List
Subject: Re: [PHP] User Authentication against remote authentication
serve r [ LDAP ]
On Mon, Oct 29, 2001 at 04:54:37PM -0700, Johnson, Kirk wrote:
Thanks for the link, Kurt. Can you also point to any
authentication code
examples, or further discussion? The user comments in the
manual suggest
there are at least a couple ways to code stuff,
ldap_compare vs ldap_bind.
Any additional help appreciated.
I might be able to help if you have some more precise questions, but
basically there are two ways LDAP can be used. You can either use it
as a data store or you can have LDAP make the authentication decision
for you. If you want the user to supply username and password, the
authentication can be done as follows:
As data store:
Hopefully the passwords are stored encrypted. Then there are two ways.
If the password is stored encrypted with some unknown salt where the
salt is stored together with the password (like the traditional UNIX
way), your PHP script retrieves the encrypted password from LDAP,
checks the salt, encrypts the user supplied password using the salt,
and compare the two. If you don't use a salt you can encrypt the
password from the user and just do an ldap_compare to check that it's
the same as in the LDAP server. You get better security by
not allowing
people to read the encrypted passwords from LDAP. To store passwords
encrypted in LDAP, SHA1 might be a good choice, PHP has this.
As decision maker:
You can simply bind to the server on behalf of the user, you use the
user supplied username and password as arguments to ldap_bind(). If
the bind succeeds, you let the user access your stuff. In this case
you should consider using SSL/TLS for talking to the server.
There are other ways to authenticate with LDAP, RFC 2829 gives a good
overview. You can find it at for instance
http://www.ietf.org/rfc/rfc2829.txt
I could go into more detail, but to write a complete general overview
would be a lot of work. You might also have a look at a really short
presentation I've made at
http://www.uninett.no/info/seminar/gnomis/ldapauth.pdf
Stig
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
