LDAP vs MySQL for Usernames and Passwords

Question

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?

Answer 1

I'm not sure I agree that "LDAP databases are more secure". After all, an LDAP server is basically a database server, with exactly the same security risks. LDAP is nice if you have the needs (software that can authenticate against LDAP, etcetera) and tooling, but security wise I don't see a difference between using LDAP and MySQL (given that you don't do stupid things like cleartext passwords or unsalted hashes).

Answer 2

Privilege Separation Principle

This is a classic case where isolation of your content database from your user database provides a security advantage.

• The Application Server knows the password for the short time until it is compared against the password retrieved from the LDAP server.
• The LDAP server delivers the user information to the app server.
• The Content database has lower sensitivity information accessed from the app server.

The LDAP database is not more secure, but it has a limited purpose, and thus the surface area for attack is much lower, as opposed to the canonical user table stored in a database which can be retrieved directly from the content database.

Note: Through a quick reading of the LDAP protocol, a password is a field in the LDAP database, so if that field is hashed (best practice) then the LDAP database doesn't need to know the plaintext password.