0

I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this solution or Django's RemoteUserBackend. Using IIS authentication would mean enabling Windows Authentication and disabling Anonymous Authentication. Conversely, using the Django solution would mean enabling Anonymous Authentication and disabling Windows Authentication.

Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network (I think). Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller? Using these settings connects and successfully authenticates users.

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution? Does a ldaps connection only matter if the site is server over https?

Improve this question

1 Answer 1

Reset to default
2

If you setup the web server with HTTP only the password will not be protected. The setting of LDAP_AUTH_USE_TLS=True only covers the protection of the connection between the server side part of your web application and the LDAP server and does not help in protecting the connection between browser and web server.

Improve this answer
2
  • that makes sense - thank you. does this hold true if the web server is hosted on the same server as the server side code of my web app? i'm guessing yes, because the link between browser and server is still unprotected. how does Windows Authentication on IIS work over http then? does Kerberos encrypt the passwords?
    – OverflowingTheGlass
    Feb 2, 2018 at 18:25
  • @CameronTaylor: this is a different question and should not be asked in a comment. But basically no password is send at all over HTTP but only short term tickets associated with the user which were retrieved outside of HTTP. Have a look at fusionsecurity.blogspot.de/2011/01/… or blogs.technet.microsoft.com/tristank/2006/08/02/…
    – Steffen Ullrich
    Feb 2, 2018 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.