Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?

share|improve this question
    
One very common mistake with authenticating against an LDAP server is not paying attention to anonymous binds. Many LDAP servers return success on an authentication attempt with an empty password, regardless of the username. –  Hendrik Brummermann Aug 9 '13 at 16:28
add comment

2 Answers

up vote 3 down vote accepted

I'm not sure I agree that "LDAP databases are more secure". After all, an LDAP server is basically a database server, with exactly the same security risks. LDAP is nice if you have the needs (software that can authenticate against LDAP, etcetera) and tooling, but security wise I don't see a difference between using LDAP and MySQL (given that you don't do stupid things like cleartext passwords or unsalted hashes).

share|improve this answer
add comment

Privilege Separation Principle

This is a classic case where isolation of your content database from your user database provides a security advantage.

  • The Application Server knows the password for the short time until it is compared against the password retrieved from the LDAP server.
  • The LDAP server delivers the user information to the app server.
  • The Content database has lower sensitivity information accessed from the app server.

The LDAP database is not more secure, but it has a limited purpose, and thus the surface area for attack is much lower, as opposed to the canonical user table stored in a database which can be retrieved directly from the content database.

Note: Through a quick reading of the LDAP protocol, a password is a field in the LDAP database, so if that field is hashed (best practice) then the LDAP database doesn't need to know the plaintext password.

share|improve this answer
    
Excellent point about limited purpose vs attack surface. Also, your last note alluded to this, but to be explicit: most LDAP databases have builtin support specifically for passwords, so you don't have to worry all about how to store passwords etc... –  AviD Jul 11 '11 at 20:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.