up vote 0 down vote favorite
2
share [g+] share [fb]

I have an LDAP plugin integrated with my web application, that part is working fine so this is not a programming question. This question relates to an LDAP search string itself. What does the search string look like if I wanted to lookup a user by username and password? If this is not possible, is there a way in LDAP for me to authenticate a user? To be clear I already have a successful bind using a service account and am not trying to connect to LDAP, that is working great, now that I can browse it however I am trying to figure out what search string is used to look up a specific user and get back the password so I can compare it. What would such an LDAP search query look like?

Some more clarity:

I am able to BIND with a service username and password as well as the remote host A-record and a BASE DN. Now I can browse a Tree as well as submit search strings and get back the results. I now want to be able to search for a user based on a form submitted username and password.

link|improve this question
74% accept rate
I would hope that all LDAP implementations would disallow password queries. You don't mention what LDAP flavour you're using, and what platform is performing the authentication request. – Simon Catlin Oct 28 '10 at 18:32
@SimonCatlin ack, I had no idea there were different versions, I was hoping this would be as simple as writing a SQLesque (or something-esque) string and then getting back a comma delimited string of attributes or something (the BIND is already encrypted over SSL/LDAPS), I have put in an e-mail to the person I am connecting to so that they can tell me what 'flavor' it is. – Ryan Oct 28 '10 at 18:41
feedback

3 Answers

up vote 1 down vote accepted

If the ldap server would allow you to query the password-attribute(s), depending on how it's stored it might be difficult to write a search-filter to match for an users password. The reason is that the userPassword attribute (assuming this is what you're using for storing passwords), may be stored with several different hashing schemes, and some of those schemes actually requires you to interpret the userPassword attribute, extract the salt, use the salt and the password supplied by the user to generate a digest, and then compare that digest against what's stored in ldap.

OpenLDAP has a faq-entry on the SHA/SSHA hashing scheme here, which also includes some code for verifying against a userPassword attribute which uses those schemes. It's quite possible to use other schemes as well, I do recall seeing MD5 and SMD5, which were pretty much the same as SSHA/SHA just with a different digest algorithm.

However, I would recommend (if possible) to bind to the users dn with the password he's supplied, and let the ldap server deal with the issue of verifying username/dn and password.

link|improve this answer
Ok thanks for the clarity, instead of binding with my system account I will just bind with any old user, hopefully this means that any user can be used to create a bind? However if I bind with any user does that mean I will be able to get that users attributes back or will I need to rebind with my system account to get this information after I get the authentication confirmed via the normal user bind? – Ryan Oct 28 '10 at 19:12
Who can bind or not is unfortunately configurable, so depending on your setup I don't know if it'll let you bind or not. Also, the system account could also be useful if there's no reliable transform from username to dn (I.e. if the users are structured in a tree, and their dn depends on where in the tree they're located, and you'd need to search first to actully find the dn to bind agaist). There are legitimate cases for searching for a particular user, and then verifying the password hash yourself, but if you can authenticate users with bind, it's a much simpler solution for you. – Kjetil Joergensen Oct 28 '10 at 19:20
ah ha, apparently I should be able to just BIND the user as you say, excellent. Any idea how, once I do the bind, I request the attributes of the users own self? – Ryan Oct 28 '10 at 20:42
When you bind to the directory as a user, you have the permissions granted to that user. You may wish to have two connections to the directory, one your system account (for performing operations), and a spare that you just use to authenticate users. As far as how to request attributes, you do it the same way as a user as you would with a system account; a normal LDAP query. – Slartibartfast Oct 29 '10 at 2:09
feedback
up vote 0 down vote

If you are implementing this into an application, it is by far less complicated to bind against the Ldap tree than to guess which hash scheme and salt was used. Binding is just one-liner and an exception/error checking.

As @Kjetil says, it is possible, but to me, not the way to do it. If you miss the salt or hash, it could end up in a false negative (clear password is ok, but hash is wrong). And besides, to get that info you need to bind anyway.

link|improve this answer
feedback
up vote 0 down vote

The format is:

LDAP://{your full domain name}/ DC={first name of your domain}, DC={2nd name of your domain} , and so on"

For example:

LDAP://foo.com/ou=Sales,cn=JSavill,dc=foo,dc=com)
link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.