102 reputation
12
bio website bernd.eckenfels.net
location Karlsruhe, Germany
age 43
visits member for 2 years, 4 months
seen Apr 12 at 19:39

Chief Architect at a german ISV. Java Guru, IT-Security freak, married and pirate.


Apr
9
comment LDAP Authentication and Sessions
Ah re "AD problem" yes right, its a general LDAP question (but if only AD has a solution for the problem I would be interested in it as well as it is a large customer base).
Apr
9
comment LDAP Authentication and Sessions
Hm, the directory servers I have worked with all check for locked, expired or restricted accounts on bind (at least for the usual conditions). This is exactly why it is usefull, I do not have to know all the different policies a company might have (based on unknown OIDs). (and the question was not about rapid kicking, its more about "within days" for remember-me type of scenarios. (and I am just mildly concerned about storing credentials just like everybody should).
Apr
7
answered Benefit to disabling TLS1.1 and TLS1.2?
Apr
7
comment LDAP Authentication and Sessions
yes I can check it with fast bind, thats why I like to use it. But I do need to have the password for that. (I have the password at the initial login, but I also need it for re-validation of existing sessions or of rembered sessions, and today I do not have the password handy at those times)
Apr
7
revised LDAP Authentication and Sessions
better justification.
Apr
7
comment LDAP Authentication and Sessions
Hopefully the users use LDAPS if they dont trust the backend network.
Apr
7
comment LDAP Authentication and Sessions
Actually for DB it works quite fine since I normally use a system DB user so I can check every few minutes if the user is not locked or has changed meta data. With LDAP i can do that only when I have a system user, but then I cant use the LDAP server policy enforcing which I get from simple binds.
Apr
7
comment LDAP Authentication and Sessions
Yes, but this does not help me, since I can set a lifetime for a http session as well. In both cases I would need the credentials (password) to re-requerst authentication.
Apr
4
comment Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?
Besides the good answers, I just want to point out, that the problem of combining multiple streams is unfortunately less common than the problem of mixing in untrusted sources into a state pool.
Apr
4
comment LDAP Authentication and Sessions
BTW: not sure how does the Web Browser SSO profile of SAML solve the session problem?
Apr
4
comment LDAP Authentication and Sessions
Yes, we also might use SAML, but this problem here is specific to using LDAP with simple bind as an authentication provider.
Apr
3
awarded  Promoter
Apr
2
awarded  Revival
Apr
2
awarded  Student
Mar
20
comment 1024-bit DHE vs 2048-bit RSA
It is fixed in Java 8 (docs.oracle.com/javase/8/docs/technotes/guides/security/… and docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/…)
Mar
6
awarded  Revival
Feb
11
awarded  Tumbleweed
Feb
4
comment Is it safe to include timestamps in error codes that are shown to the users?
You could return a short "request ID" instead. If you really have a user who wants to be nice and contact support about the error, thay can report that XID. (You could even add a "sent mail" link which includes it. Having said that, the Date: header with second resolution should be fine.
Feb
4
comment What is the ideal HMAC message format if message is an array?
actually in order to ensure order you need to sort it by key with a fixed comparator. And remeber to also specify the encoding. Personally I would concatenate zero terminated UTF8 bytes (if \0 cannot occur in data).
Feb
4
asked LDAP Authentication and Sessions