Questions tagged [ldap]

The Lightweight Directory Access Protocol is an application protocol for reading and editing directories that follow the Directory Information Model over an IP network using unsecured TCP/IP, TLS or SSL. LDAP is a binary protocol described in terms of ASN.1 and transmitted using ASN.1 Basic Encoding Rules.

Filter by
Sorted by
Tagged with
-1
votes
0answers
33 views

Active Directory LDAPS not working

I have a test domain with one domain controller. On it I have imported the root and issuing CA certificates to the appropriate certificate stores for the entire computer and have done that for every ...
1
vote
0answers
27 views

How to grant to an openldap user only a specific privilege?

I would like to create an user apart from Admin user, who should have access to update password as well as create another user in openldap. I tried configuring the user with the following ldif file. ...
3
votes
1answer
111 views

Browser not generating kerberos ticket

Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev So, I have the following scenario: A suite of webapps which use kerberos ...
2
votes
0answers
47 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
2answers
89 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
1
vote
3answers
136 views

Best practices to prevent logging of LDAP credentials by intermediate apps

I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use. We also have some internal web-based tools that interface ...
1
vote
0answers
38 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
1
vote
2answers
237 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
-1
votes
1answer
233 views

how to check if remote host is running LDAP server?

I am currently pen-testing a remote website (its mine) I would like to know if its possible to test if the web-server is running LDAP server. I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
0answers
45 views

How to query sysvol?

I exploited a machine for ex:- client2 which is a part of dev.januapp.local. Now I can enumerate users, computers etc. And also I read that we should also check sysvol But I didn't find the way to see ...
1
vote
1answer
56 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
102 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0answers
494 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
1
vote
0answers
109 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
2
votes
0answers
351 views

Bypass of LDAP authentication

In an LDAP environment that has no Radius or SSO policy whatsoever I have been told from the corporate sysadmin that: Machines that are not included into the domain could access resources (SAMBA) ...
0
votes
0answers
1k views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
2
votes
3answers
1k views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
2
votes
1answer
357 views

Is it safe to store secrets in LDAP?

Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP. Is it safe to store secret or sensitive information as an ...
1
vote
1answer
416 views

What are the security best practices for clients authenticating users with password against LDAP?

To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication)....
2
votes
1answer
276 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
1
vote
1answer
2k views

Sniffing ldap credentials?

I am going to performing an internal pentest. Is it possible to sniff active directory credentials using Wireshark or Ettercap when a user logs on and authenticates to using their domain credentials?
1
vote
0answers
647 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
1
vote
0answers
354 views

Samba or ldap-auth-client for LDAP authentication in Ubuntu client machines

We have around 100 employees using PCs, MACs and Linux machines (Ubuntu). I want to implement a central account and user authentication solution. I am planning to do it with Ubuntu machines first ...
4
votes
3answers
2k views

largely accessible encrypted passwords

Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the ...
2
votes
0answers
470 views

Active directory, limit permission on ldap, allow only to read self profile

Is possible to limit the visibility of a standard LDAP user? I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile. I tried to apply ...
1
vote
3answers
146 views

If LDAP credentials are leaked, is IP whitelist still sufficient protection?

In a situation where LDAP credentials get leaked but there is still an IP whitelist in place... My gut feeling says this isn't right; the credentials should be changed. Is this correct? What ...
1
vote
1answer
80 views

SSO Understainding Credentials and Authentication [closed]

I would like to create a SSO where my users can login to machines and wordpress (php) websites. So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
2
votes
1answer
942 views

Using LDAP for application authentication

Some of my colleagues want to get rid of our current inhouse application authentication, and use LDAPS to handle all of the authentication (storing passwords etc.) instead. I disagree and say that we ...
0
votes
1answer
499 views

DC server integrated with DNS trying to contact Blacklisted DNS hostname

Need some help in understanding below attack. The below logs are extracted from the firewall and i could see a outbound connection from ldap server to 194.169.218.42. But walking through the logs(...
0
votes
1answer
2k views

Should you use Radius and LDAP together?

For example I'm reading something right now that says: "The authentication server is a RADIUS server, which authenticates virtual machines through a Lightweight Directory Access Protocol (LDAP) ...
2
votes
2answers
129 views

LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?

Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc. It's convienient because you don't have to independantly manage authentication for ...
0
votes
1answer
534 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
5
votes
1answer
465 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
9
votes
2answers
939 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
21
votes
2answers
39k views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
21
votes
3answers
369 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
2
votes
2answers
1k views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
7
votes
4answers
36k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
3
votes
3answers
8k views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
2
votes
1answer
291 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
4
votes
1answer
1k views

How does LDAP keep an authenticated session

I feel like I'm missing something, because I'm not finding an answer Let's have a pretend scenario. I connect to an LDAP server I issues a BIND command and successfully log in (I think the sever ...
6
votes
1answer
6k views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
6
votes
1answer
458 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) each ...
3
votes
2answers
7k views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages (opposed to using a service user and ...
3
votes
1answer
464 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for /etc/...
2
votes
1answer
4k views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
1
vote
1answer
426 views

How to add user entries with password field in LDAP over HTTPS?

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
3
votes
2answers
837 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
1answer
116 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
1
vote
1answer
903 views

Ldap differences between {crypt} and {CRYPT}

I recently stumbled upon some password entries in LDAP marked with the {crypt} scheme. Since all recent entries are {CRYPT}, I was wondering what the differences between the hash algorithms are.