Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

For large values of one, one equals two, for small values of two.


devel / comp.protocols.kerberos / Re: authenticate user via ldap bind

SubjectAuthor
o Re: authenticate user via ldap bindRuss Allbery

1
Re: authenticate user via ldap bind

<mailman.84.1685373169.1964.kerberos@mit.edu>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=367&group=comp.protocols.kerberos#367

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: eagle@eyrie.org (Russ Allbery)
Newsgroups: comp.protocols.kerberos
Subject: Re: authenticate user via ldap bind
Date: Mon, 29 May 2023 08:12:40 -0700
Organization: The Eyrie
Lines: 23
Message-ID: <mailman.84.1685373169.1964.kerberos@mit.edu>
References: <8734baf3-fb80-baad-01b6-b214907813b1@thenode.info>
<87a5xngoif.fsf@hope.eyrie.org>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="30720"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
To: "John Alex. via Kerberos" <kerberos@mit.edu>
Authentication-Results: mit.edu;
dmarc=none (p=none dis=none) header.from=eyrie.org
Authentication-Results: mit.edu; arc=pass smtp.remote-ip=18.7.73.15
ARC-Seal: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1685373168; cv=pass;
b=0c6XmLt5QhFJNsLy3HNwLHfh9W4bl39Bb1qjlgTbdSiqzPz2bWpLQ0c3AX5NRq+dh7d8ugOClegfY1X1pmLu9Mg5Uqvsag5iMmf/nY15rLh0mSHSMpg3WdkuFIdVFKr1Cv+kBZfOp1Vy9xXGv0ykALxRA54CffqNo3OeqmpvYStWP0fM8nPsXmbCpqsNR1FvOiOAzaZfiRBxeIu38bj4MfNrGU3nxRU2Va+csQTOUbs36jTwQR7AAfKhsNKpkBGdqU5e0ftDsEqSRfPBciQ9pQtUhMHlSiBWGrAb6dSk7Ez5wG2KqeyZu+GIbcVWrEhFllBShJBZpsfuBq1i/Tv7Xw==
ARC-Message-Signature: i=2; a=rsa-sha256; d=mit.edu; s=arc; t=1685373168;
c=relaxed/relaxed; bh=8V8RyHEWdTev8+sRAltbyOe9T4OYJnC7ibF3TvLBxYs=;
h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;
b=PbQqBtePIrNd+3lpMYFkaDToh4Y+USG3+e4cZLTXWVYt1HPp8kVTRCjuyD2oVY9mVgTipOYEbGybtP97hr0CaoZrFvcTqPZHt6SXlytG2e1/V1+wVX7HgtLHn0QahajXJZ0iBmCuILMdn8bOvI1uv3+xHC3BlOKZcgWDb29CKM00FGCB8/N5w60Akv20B3NS6pEJmEHWPZcHMHYpvSWL37sQfROrNcfSSg11qS3a30j8Btovc6K4UqDZYK68tGIf2tmJ1QSm4tfmMqLZhr2o/EVZ2y8gfCP5YXCWQoHQVGnyM/zg0ivguiKbNSRttNe/O8LNNHUl8Iv664bWR9cesA==
ARC-Authentication-Results: i=2; mit.edu; dkim=pass (1024-bit key)
header.d=mitprod.onmicrosoft.com header.i=@mitprod.onmicrosoft.com
header.b=CkhpO0X0
Authentication-Results: mit.edu;
dkim=pass (1024-bit key) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.b=CkhpO0X0
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=NJUFrfVUIcMrVE2xwr/jug2PC1jAl4QYyRxsoUHDFmwq3CC6IpyunYUXfoPYldUMJUR6Axs0oVqOP4lTfoOAh35FenD4ZjkXCZPr4CuK29h31AtK0FWXRxXMUkcxtiM/73AoHRkk3fW2OHH//yXt08FQ7AMA9EZpt3vv9NzlJ8K/0ng5kE9AapF1IV1qTQvAvI+/0OeQSpw4HVkNyaOVzyCtk83S3TfC62Vom4a6XzeNd4qQ9ctWhv0GKT8OCOaWljCqgHwtbQ02AAh31k+NOtb3VLj+lzATj0auJzwFJNreLvVZSRTZ88C2oZdUb5zbKZradtHqAmAUsFgRrq/9lQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=8V8RyHEWdTev8+sRAltbyOe9T4OYJnC7ibF3TvLBxYs=;
b=eppUqDnBhu75oqc09EcnAK7pcj/LMSDiV/buqz0SpaJLgLi00RwUYvyj55Ejyvr8biaHhudWWcs04mzgf6zIZc8Hvb5rnrPlb3qRJMT68VAE4ggYDC3Ll+LMQdi83J3Z3LpT8Wjf6mv2W4Mzin2TODTkK+zP1SpQB1tUaSKC0hln4G3h0Qq+A6WeZcW0Li6PyoJOOr9Xj3jRo2bPOVL4EVVuwFNczKi05UEUsq5Z4uRnzYCrrd8pLuf75xfW8re3nIsODGcp0piDIN/v2Ps+Cly1hoofhIb4zmMQptdev38tCF1JRKgyLKMNPg7s96YZ6h5KtTQAxrmWL4qDJx/q+Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
166.84.7.159) smtp.rcpttodomain=mit.edu smtp.mailfrom=eyrie.org;
dmarc=bestguesspass action=none header.from=eyrie.org; dkim=none (message not
signed); arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=8V8RyHEWdTev8+sRAltbyOe9T4OYJnC7ibF3TvLBxYs=;
b=CkhpO0X0NwgwMmOxnFzYrtX2XH24wtzzVM32CNvMo9GBIlek2fCelEjrvTTxPDSUTakv9icoya9l2qGLuuH01fzbtPzIEZ212v87ch1vA4pqCEF1hQbOR/4DqCx8fFenrXFKQ2uwUIYTNQ3n0dBzkBDir+ezMzF+ZTFn4dmX99U=
Authentication-Results: spf=pass (sender IP is 166.84.7.159)
smtp.mailfrom=eyrie.org; dkim=none (message not signed)
header.d=none;dmarc=bestguesspass action=none header.from=eyrie.org;
Received-SPF: Pass (protection.outlook.com: domain of eyrie.org designates
166.84.7.159 as permitted sender) receiver=protection.outlook.com;
client-ip=166.84.7.159; helo=haven.eyrie.org; pr=C
In-Reply-To: <8734baf3-fb80-baad-01b6-b214907813b1@thenode.info> (John Alex.
via Kerberos's message of "Mon, 29 May 2023 12:38:58 +0300")
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: BN8NAM11FT053:EE_|PH0PR01MB7508:EE_
X-MS-Office365-Filtering-Correlation-Id: 2b468d00-300c-4e3e-5bc4-08db6057271c
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: uaMluM06i7Re189wlgmRsaxn1OZJKO5kNVrWPoMuH3iN/LdXnoJ7Iz50+nJs/ZQNZtKXjNwZ7qH0IOyT1STra5ALHjM7uAFuxluDQsKI86OrBBnd8yusX/P1PpqSGnYAJdjIA39Z5W2lRjtHzyYm6Y3v5o4egD+WU6cAtCQFDyVFZi/XMqld/FVyOuYw9eT8hIMkCl62kOJGZ1RaHryih+//MVDMNUDiad1ilQobyZKyS3ORCKJp3yFqZxVCviP4d/a7rdb6CbAHo3h74i9EejOPmCG0E6QD7ZHyBFKB5y4KwmKDvhNTR4XNKlF/42StwJwBSIM6smYPz3hQdJ7aUZyIZAVghcj+WItmc41vrCXgljzWtXWHfOk9L4VP1uSuVtWUlR9s9E/9S0sd/Ituk8/A8mux38Deq5xj9QiFghHYoeQRI6YbYQXLEKFrvH9m4236HPHJwDEkIyEui/H2tPN1cNpeTKd3hTSG7J2mmiK5XlSX/18xgFjNPuS3QamzwsehW2DlYUu6letjnSZcZDIa7jbAjJQOH6NX1DBeWZNfgvB7ixSCpy6XKUHyPz1hngVWqowD9fUSaGtWZHWXh79rhp5gqKz3NJ36clGf7X2afZbTZz7jsMUtEpiOo9rH
X-Forefront-Antispam-Report: CIP:166.84.7.159; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:haven.eyrie.org; PTR:haven.eyrie.org; CAT:NONE;
SFS:(13230028)(4636009)(136003)(376002)(346002)(396003)(39860400002)(451199021)(83380400001)(5660300002)(786003)(316002)(68406010)(70586007)(107886003)(4326008)(6862004)(7636003)(7596003)(8676002)(356005)(36916002)(86362001)(2906002)(42186006)(6266002)(336012)(426003)(498600001)(26005);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 May 2023 15:12:43.7023 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 2b468d00-300c-4e3e-5bc4-08db6057271c
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT053.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR01MB7508
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <87a5xngoif.fsf@hope.eyrie.org>
X-Mailman-Original-References: <8734baf3-fb80-baad-01b6-b214907813b1@thenode.info>
 by: Russ Allbery - Mon, 29 May 2023 15:12 UTC

"John Alex. via Kerberos" <kerberos@mit.edu> writes:

> In this instance, user passwords are stored in our LDAP server
> (OpenLDAP), hashed. All our services currently validate user credentials
> by attempting an LDAP bind either directly or via another protocol
> implementation (Shibboleth IdP, FreeRADIUS, Keycloak etc).

> So my question is, is there a way to implement kerberos without
> knowledge of the plaintext passwords, or do we have to somehow capture
> the credentials during users' login to other services and then sync them
> to the kdc db?

Unfortunately, although Kerberos also stores all of the passwords hashed,
the hashing algorithm used by Kerberos is almost certainly different than
the hashing algorithm used by LDAP. You therefore need the cleartext
password in order to create the KDC entry, since the point of hashing is
that it's not reversible. The only exception would be if somehow Kerberos
could be convinced to use the same hashing algorithm as LDAP, but I don't
think that's the case. (The client and the KDC have to agree on a hashing
algorithm, so this isn't a simple thing to do.)

--
Russ Allbery (eagle@eyrie.org) <https://www.eyrie.org/~eagle/>

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor