Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best practices to allow these systems to access LDAP server?

I think it's bad allowing many different systems accessing the company user directory. What would be a good solution? Do you know any references/guidelines to this type of problem?

  • You could also use an authentication system (using SAML or OpenID connect etc.) that integrates with the directory but doesn't provide direct access to the directory, especially to unauthenticated users. – Joe Nov 11 '19 at 21:15
  • 1
    Usernames are not typically considered private, so exposing them internally is not typically considered a risk – schroeder Nov 12 '19 at 11:29

You generally trust your internal applications that you allow to authenticate against an internal user directory. If you don't trust them, it does not make sense to allow then on premises, and allowing login.

Furthermore, user enumeration is usually not considered a high impact risk. Many companies have public usernames, in the form of firstname.lastname@example.com, which is rather widely distributed.

If your security relies on restricted access to LDAP, you're probably doing something wrong.

  • cool! it makes sense. Do you have any references/articles about it? – Vivi Nov 12 '19 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.