I'm wondering about LDAP, which I don't know very well.

To mitigate large compromisson in case of hack, I would like to use two different passwords for an LDAP account: a password for connecting to the web backoffice and a password for the VPN, with the same username. This way, if someone compromises a web server and store logins and passwords used for connexion, they won't be able to enter the network because the VPN password will be different. Does LDAP allow this to be done?

(PS: I will of course use a yubikey and OTP token on the backoffice and VPN but nevertheless I would like to differentiate passwords).

Thank you community !


You have different general options. Which (if any) of them work depends on your specific circumstances.

  • You can have different users (with the same username, but in different OUs) for VPN and Web. Search in the respective OU for the services.
  • If your services do not auth against LDAP but instead compare the PWs themself, you could have two password fields in the schema per record.

If these are no options, you are out of luck (and would need two user names) but in most cases, using things like OTP and Yubikeys should be enough security without having to resort to nonstandard gimmicks like this in the first place.


The best solution is to have separate user account entries for several services. With such a setup you can apply different access control policies which can be audited more easily. Make sure to associate all those user account entries with a person record so the accounts get reliably disabled in case the person leaves the organization. Also take care of persons changing names when generating (multiple) user names.

My Æ-DIR is exactly designed for that: All personal user account entries with object class aeUser have an attribute aePerson referencing a person entry typically synced from HR database (object class aePerson).

The different aeUser entries added for a person can be located in different so-called zones. This means that the administration can be delegated to different set of so-called zone admins.

Being the author I'm biased of course. Even if you don't use Æ-DIR you're welcome to borrow some of its ideas which are the result of quite some time dealing with that stuff.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.