Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How could I digitally sign LDAP data?

I want to make an LDAP request from a user machine to a proxy server that then relays the request to an LDAP server. The LDAP server would then respond with the requested data as well as a signature verifying the proxy server hasn't modified the data?

Thanks, Chenz

share|improve this question
1  
Why not make the request directly, and using SSL/TLS? –  grawity Jul 27 '09 at 15:57

2 Answers 2

Most LDAP enabled applications support Secure LDAP which is basically LDAP over TLS. The application should be checking the signtaures and reporting on any problems. This would guard against modification by the proxy..you dont say what application your using is it a COTS app or something youve hand rolled?

share|improve this answer

I don't know of any off-the-shelf standard way of doing this. SSL could work if the proxy is a simple TCP proxy that just forwards packets and rewrites parts of the TCP header, in that case the SSL session is actually terminated by the actual LDAP server. On the other hand, if the Proxy is more intelligent then that, then the SSL session would terminate with the Proxy server and you'd lose your nonrepudiation.

It is the later case that's harder to solve and has no standards. One way to do it is to construct your system so that it uses a custom written LDAP extension, or perhaps just custom attributes in the LDAP database, that when queried returns a checksum generated from the returned statement. That would allow detection of an evil proxy. Or if you require more specific nonrepudiation, generate a value based on a preshared key of some kind rather than a checksum. Unfortunately, you'd probably have to make some changes to your LDAP server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.