Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 993F6200BED for ; Sun, 1 Jan 2017 22:09:59 +0100 (CET) Received: by cust-asf.ponee.io (Postfix) id 97D52160B41; Sun, 1 Jan 2017 21:09:59 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id E1414160B24 for ; Sun, 1 Jan 2017 22:09:58 +0100 (CET) Received: (qmail 96797 invoked by uid 500); 1 Jan 2017 21:09:58 -0000 Mailing-List: contact commits-help@directory.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@directory.apache.org Delivered-To: mailing list commits@directory.apache.org Received: (qmail 96788 invoked by uid 99); 1 Jan 2017 21:09:58 -0000 Received: from Unknown (HELO svn01-us-west.apache.org) (209.188.14.144) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 01 Jan 2017 21:09:58 +0000 Received: from svn01-us-west.apache.org (localhost [127.0.0.1]) by svn01-us-west.apache.org (ASF Mail Server at svn01-us-west.apache.org) with ESMTP id A62C93A0069 for ; Sun, 1 Jan 2017 21:09:57 +0000 (UTC) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: svn commit: r1003923 - in /websites/staging/directory/trunk/content: ./ api/user-guide/5-ldap-security.html Date: Sun, 01 Jan 2017 21:09:57 -0000 To: commits@directory.apache.org From: buildbot@apache.org X-Mailer: svnmailer-1.0.9 Message-Id: <20170101210957.A62C93A0069@svn01-us-west.apache.org> archived-at: Sun, 01 Jan 2017 21:09:59 -0000 Author: buildbot Date: Sun Jan 1 21:09:57 2017 New Revision: 1003923 Log: Staging update by buildbot for directory Modified: websites/staging/directory/trunk/content/ (props changed) websites/staging/directory/trunk/content/api/user-guide/5-ldap-security.html Propchange: websites/staging/directory/trunk/content/ ------------------------------------------------------------------------------ --- cms:source-revision (original) +++ cms:source-revision Sun Jan 1 21:09:57 2017 @@ -1 +1 @@ -1776866 +1776874 Modified: websites/staging/directory/trunk/content/api/user-guide/5-ldap-security.html ============================================================================== --- websites/staging/directory/trunk/content/api/user-guide/5-ldap-security.html (original) +++ websites/staging/directory/trunk/content/api/user-guide/5-ldap-security.html Sun Jan 1 21:09:57 2017 @@ -184,11 +184,24 @@ } h2:hover > .headerlink, h3:hover > .headerlink, h1:hover > .headerlink, h6:hover > .headerlink, h4:hover > .headerlink, h5:hover > .headerlink, dt:hover > .elementid-permalink { visibility: visible }

5 - LDAP Security

+

LDAP stores critical informations, and that needs to be secured. The Apache LDAP API provides a way to access those data, there is little we can do to protect the access to those data, but we can at least make it impossible for a third party to capture the transiting data.

+

Generally speaking when it comes to securing a system, we are addressing the three As : + Authentication + Authorization +* Auditing

+

The only aspect we will focus on is the Authentication part, because the LDAP protocol does not address the two other aspects, when it comes to an API. We will shortly talk about authorization in the last chapter.

+

An additional aspect is encryption : +- securing the communication between the client and the server +- password hash

+

Last, not least, we have seen that we can bind on a LDAP server using a name and a password, but there are other ways to bind, using SASL. We will also explain how to use certificates in SSL/StartTLS.

Contents