Thanks very much, Stig, very helpful! We are just scouting the technology
right now, so my more precise questions will come later ;) We will be using
SSL. Given that, it looks to me like "decision maker" mode is the way to go?
Kirk
> -Original Message-
> From: Stig Venaas [mailto:[EMAIL PROTECTED]]
> Sent: Wednesday, October 31, 2001 3:06 AM
> To: Johnson, Kirk
> Cc: PHP General List
> Subject: Re: [PHP] User Authentication against remote authentication
> serve r [ LDAP ]
>
>
> On Mon, Oct 29, 2001 at 04:54:37PM -0700, Johnson, Kirk wrote:
> > Thanks for the link, Kurt. Can you also point to any
> authentication code
> > examples, or further discussion? The user comments in the
> manual suggest
> > there are at least a couple ways to code stuff,
> ldap_compare vs ldap_bind.
> > Any additional help appreciated.
>
> I might be able to help if you have some more precise questions, but
> basically there are two ways LDAP can be used. You can either use it
> as a data store or you can have LDAP make the authentication decision
> for you. If you want the user to supply username and password, the
> authentication can be done as follows:
>
> As data store:
>
> Hopefully the passwords are stored encrypted. Then there are two ways.
> If the password is stored encrypted with some unknown salt where the
> salt is stored together with the password (like the traditional UNIX
> way), your PHP script retrieves the encrypted password from LDAP,
> checks the salt, encrypts the user supplied password using the salt,
> and compare the two. If you don't use a salt you can encrypt the
> password from the user and just do an ldap_compare to check that it's
> the same as in the LDAP server. You get better security by
> not allowing
> people to read the encrypted passwords from LDAP. To store passwords
> "encrypted" in LDAP, SHA1 might be a good choice, PHP has this.
>
> As decision maker:
>
> You can simply bind to the server on behalf of the user, you use the
> user supplied username and password as arguments to ldap_bind(). If
> the bind succeeds, you let the user access your stuff. In this case
> you should consider using SSL/TLS for talking to the server.
>
> There are other ways to authenticate with LDAP, RFC 2829 gives a good
> overview. You can find it at for instance
> http://www.ietf.org/rfc/rfc2829.txt
>
> I could go into more detail, but to write a complete general overview
> would be a lot of work. You might also have a look at a really short
> presentation I've made at
> http://www.uninett.no/info/seminar/gnomis/ldapauth.pdf
>
> Stig
>
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]
