What are the security best practices for clients authenticating users with password against LDAP?

Question

To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication).

From what I understand, there are two approaches for user authentication:

1. Comparing password with userPassword attribute.
   • The client binds to the LDAP server using a specified bind user
   • The client sends an LDAP query to retrieve the user entry
   • The client extracts the userPassword hashing scheme
   • The client hashes the password provided by the user with the extracted hashing scheme and compares it with the hased password in the userPassword attribute
   • If both hashes match, the user is authenticated successful, otherwise authentication failed
2. LDAP Bind with user and password
   • The client binds to the LDAP server using the user who wants to log in and the password he provided
   • If the LDAP Bind was succesfull, the authentication is succesfull, otherwise authentication failed

It seems many implementation are still using the first approach, whereas the second approach seems to be more secure and also allows Pass Through authentication.

• If users need to be authenticated with a password, what are the security best practices for authenticating against LDAP and are they documented somewhere?
• Are there any other approaches than the one described above?

Answer 1

For most deployments checking the password via LDAP simple bind is the best solution. Especially because most LDAP server implementations apply password policy restrictions (pw expiry etc.) only when processing bind requests.

However there is an interesting use-case for using compare requests:

In a really paranoid LDAP setup the application would bind with a service account and would then be explicitly authorized via fine-grained ACLs to check the password on behalf of the user. Such an additional security boundary is nearly not possible with bind requests because those are always anonymous (besides looking at peer's IP address or similar).

P.S.: There are several flavors of pass-through authentication. If you have a LDAP application-level proxy you can of course forward compare requests to other LDAP servers.