Questions tagged [ldap]

The Lightweight Directory Access Protocol is an application protocol for reading and editing directories that follow the Directory Information Model over an IP network using unsecured TCP/IP, TLS or SSL. LDAP is a binary protocol described in terms of ASN.1 and transmitted using ASN.1 Basic Encoding Rules.

Filter by
Sorted by
Tagged with
0 votes
0 answers
37 views

Metasploit module for NULL LDAP credentials

This article covers the solution for the LDAP challenges on a capture the flag. I understand how the first example works, using the NULL value for the username and password to authenticate to the LDAP ...
user avatar
0 votes
0 answers
23 views

How could we fix Microsoft LDAP Enforce Channel Binding CVE-2017-8563?

I had a DC server running Microsoft Windows Server 2008 R2 x64. After a vulnerability scan launched on this server using Nexpose, the CVE-2017-8563 was reported by the vulnerability scanner with the ...
user avatar
  • 1
0 votes
2 answers
91 views

How different ldap implementations are generating random salt?

I am currently generating a salted SHA 256 passwords in the below format $hash = "{SHA256}".base64_encode(hash('sha256', $password . $salt) . $salt) . Using the below libraries of Java ...
user avatar
0 votes
0 answers
19 views

Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]

(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
user avatar
  • 163
1 vote
1 answer
199 views

Is LDAPS or StartTLS more secure?

This question has been asked and answered here, here, and also basically here. I'm asking again because the answers and information is conflicting. LDAPS: According to Wikipedia (and its RFC sources) ...
user avatar
0 votes
1 answer
109 views

How to change the password hashing scheme in LDAP using an external library with slapd.d config

I am trying to change the password hashing scheme for LDAP. Hypothetically, let's assume it's pw-argon.so I don't have slapd.conf I have the slapd.d directory where I can make changes dynamically to ...
user avatar
0 votes
1 answer
156 views

How to overcome MD4 hashing in SAMBA

We are using a Samba configuration on our RedHat (RHEL7.9) systems, where SMB authentication is based on an NTLM password hash, which is basically a clear-text credential for a challenge-response ...
user avatar
0 votes
0 answers
308 views

What does LDAP have to do with X.509 Certificates

I'm working with certificates programmatically through .NET. I usually give the certificate a DN by giving it string like this: "c=eg,s=cairo,st=Nozha,cn=Foo Ltd.,..” But there is another way to ...
user avatar
  • 147
0 votes
1 answer
408 views

LDAP StartTLS encryption - which TLS versions are supported?

I am looking to set a third party application to authenticate with our domain. The application supports LDAPv3 and we have opted to use the start StartTLS extension to encrypt the credentials from the ...
user avatar
  • 1
3 votes
2 answers
541 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
user avatar
  • 140
0 votes
1 answer
132 views

Having a backdoor password for each user to allow impersonation

For some context, I want my api to be able to 'impersonate' (or connect as) a user on my ldap database as most of the api's access controls are on the ldap database and tied to the user you are ...
user avatar
  • 43
2 votes
1 answer
87 views

Is an LDAP injection possible for a basic search query?

I'm trying to secure a login endpoint by attempting to bypass the login that uses LDAP. It employs a search query of "cn=" + username + ", dc=example, dc=com" with a filter of "(objectClass=*)". Is ...
user avatar
  • 123
0 votes
1 answer
175 views

Is kerberos unconstrained delegation partially safer than constrained delegation?

When you're using unconstrained delegation, a service A is allowed to authenticate as the user B to any other service. This happens because the user B sends its TGS along with its TGT to the service A,...
user avatar
2 votes
1 answer
631 views

Is LDAP encrypted after SASL authentication?

I was inspecting LDAP packets wit Wireshark today. When I authenticate with simple bind, I can see the password in plain text and subsequent LDAP requests and responses. Then I was authenticating ...
user avatar
  • 334
1 vote
0 answers
1k views

Active Directory authentication with a Login form ASP.NET MVC5

I want to create a web application with a login form and authenticate with Active Directory account. Our users sometimes use a device that users cannot log in, so we don't want to use Windows ...
user avatar
  • 11
2 votes
1 answer
118 views

Partially controlling LDAP BindDN parameter

In an application I was assessing, I found an interesting piece of code that took my attacker-supplied input and put it into the bindDN while preparing to connect to an LDAP server. [USERNAME]@domain....
user avatar
  • 239
1 vote
0 answers
239 views

OpenLDAP encrypt database or by attributes

I run an OpenLDAP server on which there is some data I wanted to encrypt. I cannot use a userPassword like attributes as this is hash. In my case I need to crypt/decrypt it with a secret key. But if ...
user avatar
1 vote
1 answer
276 views

How do companies authenticate internal users in internal systems?

Assuming that a company has an AD/LDAP server with accounts for all employees and has many internal systems that must authenticate those users, what would be a good solution in terms of security best ...
user avatar
  • 69
3 votes
1 answer
2k views

Browser not generating kerberos ticket

Firstly, please apologise me if I'm still confused about stuff here, Kerberos auth is quite the complex issue for a java dev So, I have the following scenario: A suite of webapps which use kerberos ...
user avatar
  • 83
2 votes
0 answers
360 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
user avatar
2 votes
2 answers
276 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
user avatar
1 vote
3 answers
395 views

Best practices to prevent logging of LDAP credentials by intermediate apps

I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use. We also have some internal web-based tools that interface ...
user avatar
1 vote
0 answers
165 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
user avatar
2 votes
2 answers
446 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
user avatar
0 votes
1 answer
3k views

how to check if remote host is running LDAP server?

I am currently pen-testing a remote website (its mine) I would like to know if its possible to test if the web-server is running LDAP server. I tried Nmap with no luck(it lists every port from 1 to ...
user avatar
1 vote
1 answer
162 views

Obfuscating password LDAP AD

I have my parameters in a properties file. managerDn=cn=read-only-admin,dc=example,dc=com managerPassword=69BPoqG3sWr/MNspi4ZsDw== server=ldaps://server.local:636 groupSearchBase=ou=test,dc=example,...
user avatar
0 votes
1 answer
160 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
user avatar
1 vote
0 answers
911 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
user avatar
  • 1,675
1 vote
0 answers
251 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
user avatar
2 votes
0 answers
602 views

Bypass of LDAP authentication

In an LDAP environment that has no Radius or SSO policy whatsoever I have been told from the corporate sysadmin that: Machines that are not included into the domain could access resources (SAMBA) ...
user avatar
  • 360
0 votes
0 answers
2k views

OpenLDAP security SSHA [duplicate]

In OpenLDAP documentation I can find information that it supports the following encryption schemes: MD5, SMD5, SHA and SSHA. From these schemes the most secure is SSHA (SHA-1 with salt), but it still ...
user avatar
  • 1,097
2 votes
3 answers
2k views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
user avatar
  • 21
2 votes
1 answer
672 views

Is it safe to store secrets in LDAP?

Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP. Is it safe to store secret or sensitive information as an ...
user avatar
  • 1,410
1 vote
1 answer
734 views

What are the security best practices for clients authenticating users with password against LDAP?

To secure an OpenLDAP environment I'm investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication)....
user avatar
1 vote
1 answer
411 views

User Credentials for Accessing Network Resources

I am in the process of setting up the infrastructure for microservices using RabbitMQ as our message broker for our company. I am trying to figure out the best way to handle security for the system. ...
user avatar
1 vote
1 answer
3k views

Sniffing ldap credentials?

I am going to performing an internal pentest. Is it possible to sniff active directory credentials using Wireshark or Ettercap when a user logs on and authenticates to using their domain credentials?
user avatar
  • 7
1 vote
0 answers
975 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
user avatar
  • 130
1 vote
0 answers
440 views

Samba or ldap-auth-client for LDAP authentication in Ubuntu client machines

We have around 100 employees using PCs, MACs and Linux machines (Ubuntu). I want to implement a central account and user authentication solution. I am planning to do it with Ubuntu machines first ...
user avatar
  • 111
4 votes
3 answers
2k views

largely accessible encrypted passwords

Suppose your university has a centralized ldap server used to authenticate all students, teachers and staff for all services provided by the university (email, exams, taxes...) Suppose that in the ...
user avatar
  • 43
2 votes
0 answers
602 views

Active directory, limit permission on ldap, allow only to read self profile

Is possible to limit the visibility of a standard LDAP user? I'd like standard users are allowed to read only their personal information, and deny them to read someone else profile. I tried to apply ...
user avatar
  • 71
1 vote
3 answers
202 views

If LDAP credentials are leaked, is IP whitelist still sufficient protection?

In a situation where LDAP credentials get leaked but there is still an IP whitelist in place... My gut feeling says this isn't right; the credentials should be changed. Is this correct? What ...
user avatar
  • 115
1 vote
1 answer
126 views

SSO Understainding Credentials and Authentication [closed]

I would like to create a SSO where my users can login to machines and wordpress (php) websites. So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
user avatar
2 votes
1 answer
1k views

Using LDAP for application authentication

Some of my colleagues want to get rid of our current inhouse application authentication, and use LDAPS to handle all of the authentication (storing passwords etc.) instead. I disagree and say that we ...
user avatar
0 votes
1 answer
725 views

DC server integrated with DNS trying to contact Blacklisted DNS hostname

Need some help in understanding below attack. The below logs are extracted from the firewall and i could see a outbound connection from ldap server to 194.169.218.42. But walking through the logs(...
user avatar
  • 97
1 vote
1 answer
3k views

Should you use Radius and LDAP together?

For example I'm reading something right now that says: "The authentication server is a RADIUS server, which authenticates virtual machines through a Lightweight Directory Access Protocol (LDAP) ...
user avatar
2 votes
2 answers
185 views

LDAP allows conveniently centralised authentication - but can this lead to complacent security practises?

Say you work for LargeCorp, you have a LDAP login to access your desktop, access various internal applications etc. It's convienient because you don't have to independantly manage authentication for ...
user avatar
1 vote
1 answer
1k views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
user avatar
5 votes
1 answer
560 views

How to implement a password change policy when user's centralized password is in a lot of places?

I would like to implement password changing in an organization but they have the domain controller/LDAP passwords "all over the place". They have the passwords in a lot of places, for example, in ...
user avatar
9 votes
2 answers
1k views

What LDAP schema is recommended for PKI?

In my research, I found some RFCs that have not been updated in over a decade, e.g draft-ietf-pkix-ldap-crl-schema-01. I also explored several public directories used in PKI (e.g. x500.bund.de) and ...
user avatar
  • 255
27 votes
2 answers
56k views

Kerberos vs. LDAP for authentication -- which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
user avatar
  • 1,582