You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@directory.apache.org by Emmanuel Lecharny <el...@gmail.com> on 2007/03/10 18:23:34 UTC
[Authenticator] Question regarding encrypted passwords
Hi guys,
I have a doubt, may be you have a clear vision about this point :
is it the server responsability to compare the user's password against
an encrypted form or should the client encrypt the password before
sending it to the server ?
I mean, we can have one of those two possibilities :
1) [client] --(clear password)--> <network> --> [server] --> encrypt the
password and compares it to the stored encrypted password
or
2) [client] --(encrypt password)--> <network> [server] --> compares the
encrypted password and compares it to the stored encrypted password
?
Emmanuel
PS : we have solution 1 currently implemented. Is it correct ?
Re: [Authenticator] Question regarding encrypted passwords
Posted by Emmanuel Lecharny <el...@gmail.com>.
Stefan Zoerner a écrit :
>
> This is intended. If someone was able to catch this value (from an
> LDIF export for instance), s/he must still provide the password itself
> in order to get authenticated.
Of course, stupid me !!! Thanks a lot Stefan for your answer, I wasn't
able to find the (obvious) rationnal for this decision...
Emmanuel
Re: [Authenticator] Question regarding encrypted passwords
Posted by Enrique Rodriguez <en...@gmail.com>.
On 3/11/07, Stefan Zoerner <st...@labeo.de> wrote:
> ...
> This is why I think option 2 is not recommended at all. By the way: the
> following servers behave exactly the same:
>
> * OpenLDAP 2.3
> * Sun Java System Directory Server 5.2
> * IBM Tivoli Directory Server 6.0
We also want the plaintext so we can keep the symmetric keys used by
Kerberos, Change Password, and LDAP+GSSAPI in synch. I discuss this
on the "Security Initiatives" page:
http://cwiki.apache.org/confluence/display/DIRxSBOX/Security+Initiatives
Enrique
Re: [Authenticator] Question regarding encrypted passwords
Posted by Stefan Zoerner <st...@labeo.de>.
Emmanuel Lecharny wrote:
> is it the server responsability to compare the user's password against
> an encrypted form or should the client encrypt the password before
> sending it to the server ?
>
> I mean, we can have one of those two possibilities :
> 1) [client] --(clear password)--> <network> --> [server] --> encrypt the
> password and compares it to the stored encrypted password
> or
> 2) [client] --(encrypt password)--> <network> [server] --> compares the
> encrypted password and compares it to the stored encrypted password
>
> ...
>
> PS : we have solution 1 currently implemented. Is it correct ?
>
Hi Emmanuel!
Option 1 is currently implemented. The client can not authenticate via
simple bind with the encrypted (digested) value. S/he must send the
password in clear (ideally via ldaps). See here:
http://directory.apache.org/apacheds/1.0/31-authentication-options.html
Cite:
--8<--
Providing the hashed value of the userpassword attribute instead of the
original value will be rejected by ApacheDS:
$ ldapsearch -h zanzibar -p 10389 -D "cn=Horatio
Hornblower,ou=people,o=sevenSeas" \\
-w "{SHA}nU4eI71bcnBGqeO0t9tXvY1u5oQ=" -b "ou=people,o=sevenSeas"
-s base "(objectclass=*)"
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: Bind failed: null
This is intended. If someone was able to catch this value (from an LDIF
export for instance), s/he must still provide the password itself in
order to get authenticated.
-->8--
This is why I think option 2 is not recommended at all. By the way: the
following servers behave exactly the same:
* OpenLDAP 2.3
* Sun Java System Directory Server 5.2
* IBM Tivoli Directory Server 6.0
Greetings,
Stefan
Re: [Authenticator] Question regarding encrypted passwords
Posted by Ole Ersoy <ol...@gmail.com>.
Cool.
Yeah - For roadmap stuff I was thinking different UI.
The vote can still be stored in JIRA.
Anyways that's a little ways down the road :-)
Emmanuel Lecharny wrote:
> Yeah, 1 is the way to go. Forget about 2, it creates a security breach.
>
> For roadmap, we use Jira, and you can vote for using it. The wheel
> already exists ;)
>
> On 3/10/07, * Ole Ersoy* <ole.ersoy@gmail.com
> <ma...@gmail.com>> wrote:
>
> Short answer:
>
> I think 1
>
> Longer answer/example:
>
> Tomcat Authentication
>
> User requests password page and provides credentials.
>
> Browser encrypts post and sends it.
>
> Tomcat ssl decrypts.
>
> Authentication is then performed on the
> authentication store (ADS possibly).
>
> So I think the network usually takes care of securing itself, when
> needed.
>
> I would probably leave 2 as "possible feature" and post it on our
> roadmap
> so that users can vote on it.
>
> I'll try to create a "Dell IdeaStorm" page for our road map later
> so that
> features can be voted for.
>
> Cheers,
> - Ole
>
>
>
>
>
>
> Emmanuel Lecharny wrote:
> > Hi guys,
> >
> > I have a doubt, may be you have a clear vision about this point :
> >
> > is it the server responsability to compare the user's password
> against
> > an encrypted form or should the client encrypt the password before
> > sending it to the server ?
> >
> > I mean, we can have one of those two possibilities :
> > 1) [client] --(clear password)--> <network> --> [server] --> encrypt
> > the password and compares it to the stored encrypted password
> > or
> > 2) [client] --(encrypt password)--> <network> [server] --> compares
> > the encrypted password and compares it to the stored encrypted
> password
> >
> > ?
> >
> > Emmanuel
> >
> > PS : we have solution 1 currently implemented. Is it correct ?
> >
>
>
>
>
> --
> Cordialement,
> Emmanuel Lécharny
> www.iktek.com <http://www.iktek.com>
Re: [Authenticator] Question regarding encrypted passwords
Posted by Emmanuel Lecharny <el...@gmail.com>.
Yeah, 1 is the way to go. Forget about 2, it creates a security breach.
For roadmap, we use Jira, and you can vote for using it. The wheel already
exists ;)
On 3/10/07, Ole Ersoy <ol...@gmail.com> wrote:
>
> Short answer:
>
> I think 1
>
> Longer answer/example:
>
> Tomcat Authentication
>
> User requests password page and provides credentials.
>
> Browser encrypts post and sends it.
>
> Tomcat ssl decrypts.
>
> Authentication is then performed on the
> authentication store (ADS possibly).
>
> So I think the network usually takes care of securing itself, when needed.
>
> I would probably leave 2 as "possible feature" and post it on our roadmap
> so that users can vote on it.
>
> I'll try to create a "Dell IdeaStorm" page for our road map later so that
> features can be voted for.
>
> Cheers,
> - Ole
>
>
>
>
>
>
> Emmanuel Lecharny wrote:
> > Hi guys,
> >
> > I have a doubt, may be you have a clear vision about this point :
> >
> > is it the server responsability to compare the user's password against
> > an encrypted form or should the client encrypt the password before
> > sending it to the server ?
> >
> > I mean, we can have one of those two possibilities :
> > 1) [client] --(clear password)--> <network> --> [server] --> encrypt
> > the password and compares it to the stored encrypted password
> > or
> > 2) [client] --(encrypt password)--> <network> [server] --> compares
> > the encrypted password and compares it to the stored encrypted password
> >
> > ?
> >
> > Emmanuel
> >
> > PS : we have solution 1 currently implemented. Is it correct ?
> >
>
>
--
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [Authenticator] Question regarding encrypted passwords
Posted by Ole Ersoy <ol...@gmail.com>.
Short answer:
I think 1
Longer answer/example:
Tomcat Authentication
User requests password page and provides credentials.
Browser encrypts post and sends it.
Tomcat ssl decrypts.
Authentication is then performed on the
authentication store (ADS possibly).
So I think the network usually takes care of securing itself, when needed.
I would probably leave 2 as "possible feature" and post it on our roadmap
so that users can vote on it.
I'll try to create a "Dell IdeaStorm" page for our road map later so that
features can be voted for.
Cheers,
- Ole
Emmanuel Lecharny wrote:
> Hi guys,
>
> I have a doubt, may be you have a clear vision about this point :
>
> is it the server responsability to compare the user's password against
> an encrypted form or should the client encrypt the password before
> sending it to the server ?
>
> I mean, we can have one of those two possibilities :
> 1) [client] --(clear password)--> <network> --> [server] --> encrypt
> the password and compares it to the stored encrypted password
> or
> 2) [client] --(encrypt password)--> <network> [server] --> compares
> the encrypted password and compares it to the stored encrypted password
>
> ?
>
> Emmanuel
>
> PS : we have solution 1 currently implemented. Is it correct ?
>