once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network:
<the Internet> | | A | B Users <---------> [squid-Server] <---> [LDAP-Server]
Users request access to the Internet,
squid ask their name and passport, authenticate them by
LDAP and if ldap approved them, then he granted them.
Everyone was happy until some sniffers stole passport in path between users and squid [path A]. This disaster happened because squid used
The people of jungle gathered to solve the problem. Some bunnies offered using
NTLM of method. Snakes prefered
Kerberos recommended by trees.
After all, many solution offered by people of jungle and all was confused! The Lion decided to end the situation. He shouted the rules for solutions:
- Shall the solution be secure!
- Shall the solution work for most of browsers and softwares (e.g. download softwares)
- Shall the solution be simple and do not need other huge subsystem (like Samba server)
- Shall not the method depend on special domain. (e.g. Active Directory)
Then, a very resonable-comprehensive-clever solution offered by a monkey, making him the new king of the jungle!
can you guess what was the solution?
The path between
LDAP is protected by the lion, so the solution have not to secure it.
Note: sorry if the story is boring and messy, but most of it is real! =)
/~\/~\/~\ /\~/~\/~\/~\/~\ ((/~\/~\/~\/~\/~\)) (/~\/~\/~\/~\/~\/~\/~\) (//// ~ ~ \\\\) (\\\\( (0) (0) )////) (\\\\( __\-/__ )////) (\\\( /-\ )///) (\\\( (""""") )///) (\\\( \^^^/ )///) (\\\( )///) (\/~\/~\/~\/) ** (\/~\/~\/) *####* | | **** /| | | |\ \\ _/ | | | | \_ _________// Thanks! (,,)(,,)_(,,)(,,)--------'
Massimo explained that the authenticating method between
LDAP does not have to be same. we can use arbitary method to get authentication information from users and arbitary method to authenticated gathered data.
But there is a problem: the input/output of all types of authenticators is not same. For example:
Basicauthenticator should read "username password" pair in a line and reply a
OKif user-pass is correct or
Digestauthenticator should read a
username:realmand reply a hex-encoded of
Althought there is no direct relationship between client-squid method and squid-ldap method, the gathered data from client must be compatible with method used in squid-ldap part. Therefore, if we change authenticating method in users-side, we maybe should change our authenticator too.
So the problem simplifies to:
In first level, i (the monkey!) am looking for a good authentication method in user-side. Which method do you recommend which is secure and supported by most browsers? i am in confused between
Where i can find an authenticator which supports credentials information of selected method and authenticates through LDAP.