What I am doing...
Trying to implement single-sign-on for our organization’s all machines, blogs, wiki’s, CRM, HRM, project management tools, SVN, etc, etc...
We have OpenLDAP installed and configured on our dedicated server running CentOS. I used phpLdapAdmin to add organization structure and info about various users, clients, resources.
An example entry for a user...
DN is :: cn=Bill Gates, ou=users, dc=example, dc=com
userid :: bill.gates
mail :: firstname.lastname@example.org
userpassword :: as2%$%66789ds (some md5 cryptic value)
Where I am now...
OpenLDdap is working fine. Bind test also ran successfully.
What I want to do...
Bind using higher privilege user and then search users by their entered userid or mail, which are slightly different from CN. Point is I want to authenticate user against an attribute which is not part of RDN.
Where I am stuck...
- I can’t bind using userid as its not apart of DN. Is this allowed in general?
- I can bind using different LDAP user say, high-privileged user and do ldap_search to get a unique record based on filter userId but then md5 of user entered password doesn't match with userPassword field. OpenDLdap encrypts using some salt. I don't want to remove salt either. Is there any way out?
My questions (finally)
- Can we do ldap_bind on an attribute which is not part of RDN?
- Can we send a unencrypted password (I will use HTTPS tunnel for security) to OpenLDAP server and ask OpenLDAP to encrypt is and check against userpassword filed? This is normally we do in all web-apps, right?
- (off-topic) Can userid contain . (dots) and spaces. We need some char between “First Name(givenName)” and "Last Name(sn)". Which one is safe character? I mean which non-aplha-numeric character is allowed in usernames by world's all (or most) application?
My biggest concern is to go with an approach, which can be easily made to work with most apps. There are many web-based apps, desktop softwares, etc which we will be modifying during our mission single sign-on!
Thanks for reading... and thanks in advance for some help!