Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ldap]

The Lightweight Directory Access Protocol is an application protocol for reading and editing directories that follow the Directory Information Model over an IP network using unsecured TCP/IP, TLS or SSL. LDAP is a binary protocol described in terms of ASN.1 and transmitted using ASN.1 Basic Encoding Rules.

1
vote
0answers
14 views

How to intercept AD authentication attempts [on hold]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
0
votes
0answers
19 views

oAuth2 and LDAP integration

I have set of APIs which are written based on oauth 2.0. in my system currently all the user accounts are saved in MySQL DB. Now I want to integrate LDAP with this system to verify users through LDAP ...
1
vote
1answer
60 views
+50

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
-1
votes
1answer
56 views

how to check if remote host is running LDAP server?

I am currently pen-testing a remote website (its mine) I would like to know if its possible to test if the web-server is running LDAP server. I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
0answers
19 views

How to query sysvol?

I exploited a machine for ex:- client2 which is a part of dev.januapp.local. Now I can enumerate users, computers etc. And also I read that we should also check sysvol But I didn't find the way to see ...
1
vote
1answer
47 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
0
votes
1answer
89 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0answers
280 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
1
vote
0answers
64 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
2
votes
0answers
231 views

Bypass of LDAP authentication

In an LDAP environment that has no Radius or SSO policy whatsoever I have been told from the corporate sysadmin that: Machines that are not included into the domain could access resources (SAMBA) ...
0
votes
0answers
637 views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
2
votes
3answers
931 views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
2
votes
1answer
254 views

Is it safe to store secrets in LDAP?

Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP. Is it safe to store secret or sensitive information as an ...
1
vote
1answer
288 views

What are the security best practices for clients authenticating users with password against LDAP?

To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication)....
2
votes
1answer
224 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
1
vote
1answer
1k views

Sniffing ldap credentials?

I am going to performing an internal pentest. Is it possible to sniff active directory credentials using Wireshark or Ettercap when a user logs on and authenticates to using their domain credentials?
1
vote
0answers
546 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
1
vote
0answers
322 views

Samba or ldap-auth-client for LDAP authentication in Ubuntu client machines

We have around 100 employees using PCs, MACs and Linux machines (Ubuntu). I want to implement a central account and user authentication solution. I am planning to do it with Ubuntu machines first ...
4
votes
3answers
2k views

largely accessible encrypted passwords

Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the ...
2
votes
0answers
399 views

Active directory, limit permission on ldap, allow only to read self profile

Is possible to limit the visibility of a standard LDAP user? I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile. I tried to apply ...
1
vote
3answers
130 views

If LDAP credentials are leaked, is IP whitelist still sufficient protection?

In a situation where LDAP credentials get leaked but there is still an IP whitelist in place... My gut feeling says this isn't right; the credentials should be changed. Is this correct? What ...
1
vote
1answer
68 views

SSO Understainding Credentials and Authentication [closed]

I would like to create a SSO where my users can login to machines and wordpress (php) websites. So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
2
votes
1answer
717 views

Using LDAP for application authentication

Some of my colleagues want to get rid of our current inhouse application authentication, and use LDAPS to handle all of the authentication (storing passwords etc.) instead. I disagree and say that we ...
0
votes
0answers
40 views

Is there a way to locking down ldap quieries

Is there a way to locking down ldap queries to a specific security group / or users? We have a Windows 2008 functional level domain. Around 400 users. We want to see if ldap queries to our domain can ...
0
votes
1answer
439 views

DC server integrated with DNS trying to contact Blacklisted DNS hostname

Need some help in understanding below attack. The below logs are extracted from the firewall and i could see a outbound connection from ldap server to 194.169.218.42. But walking through the logs(...
0
votes
1answer
2k views

Should you use Radius and LDAP together?

For example I'm reading something right now that says: "The authentication server is a RADIUS server, which authenticates virtual machines through a Lightweight Directory Access Protocol (LDAP) ...
2
votes
2answers
122 views

LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?

Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc. It's convienient because you don't have to independantly manage authentication for ...
0
votes
1answer
479 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
5
votes
1answer
411 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
9
votes
2answers
797 views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
21
votes
2answers
34k views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
21
votes
3answers
349 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
2
votes
2answers
971 views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
7
votes
4answers
29k views

Extract Password Hashes from Active Directory LDAP

Currently we are working on a monthly internal security test which among other should contain a verification of the real password strength the users choose. For this reason I want to extract the ...
2
votes
3answers
7k views

Hashing passwords in OpenLDAP

I've seen a few posts on the internet saying most people store user passwords in OpenLDAP using one of OpenLDAP's many, built-in hashing functions. But OpenLDAP itself recommends handing off password ...
2
votes
1answer
257 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
4
votes
1answer
1k views

How does LDAP keep an authenticated session

I feel like I'm missing something, because I'm not finding an answer Let's have a pretend scenario. I connect to an LDAP server I issues a BIND command and successfully log in (I think the sever ...
6
votes
1answer
5k views

What is the best way to store passwords in OpenLDAP?

I would like to store user credentials in an OpenLDAP or similar directory server. A lot of online commentary about storing passwords in modern contexts recommends using password derivation schemes ...
6
votes
1answer
430 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) each ...
3
votes
2answers
6k views

LDAP Authentication and Sessions

Given a Web Application with Form-based login and a central directory: using LDAP (fast) bind in an application with the actual user has a number of advantages (opposed to using a service user and ...
2
votes
1answer
451 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for /etc/...
2
votes
1answer
4k views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
1
vote
1answer
398 views

How to add user entries with password field in LDAP over HTTPS?

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
3
votes
2answers
765 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
1answer
112 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
1
vote
1answer
837 views

Ldap differences between {crypt} and {CRYPT}

I recently stumbled upon some password entries in LDAP marked with the {crypt} scheme. Since all recent entries are {CRYPT}, I was wondering what the differences between the hash algorithms are.
5
votes
3answers
20k views

Is it secure to be using LDAP, or is LDAPS the only secure option?

I am currently using an LDAP setup. I am wondering if it is secure from Man-in-the-middle attacks or other vulnerabilities?
8
votes
2answers
5k views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
0
votes
1answer
571 views

.net System.Security.Principal.WindowsPrincipal user namespace ldap injection

A recent scan of a .net web application detected an ldap injection vulnerability for a field that was used for a username assigned to an instance of a custom class named User. After stepping through ...
0
votes
1answer
2k views

LDAP and anonymous bind for PCI compliance

We have to setup a central auth for PCI compliance and I'm wondering if it's ok to allow anonymous bind or should I create a user to do the bind for the services needing ldap?