I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this solution or Django's RemoteUserBackend. Using IIS authentication would mean enabling Windows Authentication and disabling Anonymous Authentication. Conversely, using the Django solution would mean enabling Anonymous Authentication and disabling Windows Authentication.
Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network (I think). Is the same thing happening when I set LDAP_AUTH_USE_TLS = True
and my LDAP_AUTH_URL
is pointing to an LDAPS
domain controller? Using these settings connects and successfully authenticates users.
Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution? Does a ldaps connection only matter if the site is server over https?