As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL.
The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The second one sends the password in clear, and hence is not suitable if one is not willing to implement it over something like SSL (due to compatibility issues or legal reasons).
This leaves us with the third option: SASL. As listed on IANA, there are several SASL-based authentication mechanisms to pick from. Some of them are obsolete or in limited use, but others are common.
I want to pick a SASL-based authentication mechanism, with the following features:
- It is password based (in contrast to, say, SecurID, which AFAIK is token based).
- Its security is not based on an underlying protocol (e.g., SSL).
- The protocol does not require users' passwords to be stored in clear (for instance, CRAM-MD5 may do this).
- It is widely implemented.
Could you please suggest my options?