django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http

Question

I have implemented django-python3-ldap and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am deciding between using this solution or Django's RemoteUserBackend. Using IIS authentication would mean enabling Windows Authentication and disabling Anonymous Authentication. Conversely, using the Django solution would mean enabling Anonymous Authentication and disabling Windows Authentication.

Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network (I think). Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller? Using these settings connects and successfully authenticates users.

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution? Does a ldaps connection only matter if the site is server over https?

Answer 1

If you setup the web server with HTTP only the password will not be protected. The setting of LDAP_AUTH_USE_TLS=True only covers the protection of the connection between the server side part of your web application and the LDAP server and does not help in protecting the connection between browser and web server.