Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios where an admin account on one system is an admin account on another.
What are the primary risks we should be thinking about when integrating applications into LDAP? Are there significant problems with Kerberos we should be controlling for?
Your question is a bit broad and especially does not make clear whether you're using LDAP or Kerberos for authentication.
I'm pretty sure there are tons of web pages providing information about security best practices for MS Active Directory in general.
Some important aspects regarding applications:
If you use LDAP simple bind for letting your applications check the user's password then all these applications have access to the user's clear-text password
If you use Kerberos then bear in mind that the services' keys are always protected. Because if an attacker can get a copy of the shared secret of a service he can impersonate as any user to that particular service.
In general I'd recommend to use a single sign-on method based on asymmetric crypto. At least for web applications that's not that hard anymore.
