The Lightweight Directory Access Protocol is an application protocol for reading and editing directories that follow the Directory Information Model over an IP network using unsecured TCP/IP, TLS or SSL. LDAP is a binary protocol described in terms of ASN.1 and transmitted using ASN.1 Basic Encoding ...
8
votes
1answer
153 views
What practical uses are there for the AD feature of “Confidential Attributes”
Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?
Would you store sensitive information here such as a private key, or a salt here?
I'm ...
5
votes
1answer
236 views
Oracle Internet Directory (OID) hardening
What are best practices, recommendations, required reading for securing/hardening an Oracle internet directory?
note: OID is compatible with LDAP version 3.
4
votes
1answer
104 views
Complex Consumer Matching Queries with PGP Universal
For group membership I am using LDAP for performing the consumer matching. I can pretty clearly see how to do simple matches with ORs or ANDs, but I would like to match in a more complicated fashion. ...
3
votes
2answers
312 views
SASL Authentication Protocol with No Cleartext passwords
As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL.
The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
2
votes
2answers
1k views
LDAP vs MySQL for Usernames and Passwords
I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
2
votes
2answers
470 views
LDAP Security problems?
I have installed many Active Directiory based networks and have applied various standard security templates based on best practices, however I have never really looked at LDAP on a deeper level and ...
2
votes
2answers
153 views
Vuln Web App which includes LDAP Injection?
I want to check several techniques for LDAP injection, but I cannot find a vulnerable application (like Webgoat, Hacme etc.) which uses LDAP injection.
Do you know of any vulnerable web application ...
2
votes
1answer
291 views
What information is exposed in AD's Service Connection Points (SCP)
Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have ...
0
votes
1answer
532 views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
0
votes
2answers
90 views
OpenLDAP version 2.4.24 at risk? Site to check for known vulnerabilities with version used?
We use OpenLDAP version 2.4.24
$ /usr/local/libexec/slapd -VV
@(#) $OpenLDAP: slapd 2.4.24 (Mar 5 2011 06:36:43) $
steve@sunblade2500:/bigdisk/SOURCES/S10/openldap-2.4.24/servers/slapd
...
