The steps below are general enough to be used by anyone and will hopefully shed some light into the steps performed in LDAP authentication. The process below also includes some steps for authorization.
Authentication
1. Get a connection to the LDAP server.
With the host and port for the LDAP server, create a connection to it. This can be a simple direct connection or a pooled connection. If more than a basic test, it is best to use a pooled connection. Log and fail if a connection cannot be created.
With the host and port for the LDAP server, create a connection to it. This can be a simple direct connection or a pooled connection. If more than a basic test, it is best to use a pooled connection. Log and fail if a connection cannot be created.
2. Bind as the application user.
Bind the connection to the application user. This user should have enough permissions to search the area of LDAP where users are located. This user may also have permissions to search for things outside of the users area (groups, authorization). Log and fail if the application user cannot bind.
Bind the connection to the application user. This user should have enough permissions to search the area of LDAP where users are located. This user may also have permissions to search for things outside of the users area (groups, authorization). Log and fail if the application user cannot bind.
3. Search for the DN (distinguished name) of the user to be authenticated.
This is where we verify the username is valid. This does not authenticate the user but simply makes sure the requested username exists in the system. Log and fail if the user’s DN is not found.
This is where we verify the username is valid. This does not authenticate the user but simply makes sure the requested username exists in the system. Log and fail if the user’s DN is not found.
4. Bind as user to be authenticated using DN from step 3.
Now for the moment of truth. Bind to the connection using the DN found in step 3 and the password supplied by the user. Log and fail if unable to bind using the user’s DN and password.
Now for the moment of truth. Bind to the connection using the DN found in step 3 and the password supplied by the user. Log and fail if unable to bind using the user’s DN and password.
Authorization
5. Re-bind as application user.
To check the authorization of a user, we need to read attributes from the user’s account. To do this, we need to re-bind as the application user.
To check the authorization of a user, we need to read attributes from the user’s account. To do this, we need to re-bind as the application user.
6. Search for user and require attributes.
A filter is used to search for the user like was done in step 3 but we’ll add an extra check to the query to look for the attributes that show we’re authorized.
A filter is used to search for the user like was done in step 3 but we’ll add an extra check to the query to look for the attributes that show we’re authorized.
Example Code
Courtesy:http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorization-dissected-and-digested/
Nice post very helpful
ReplyDeletedbakings