TCP/IP Tutorial and Technical Overview - IBM Redbooks

12.4.5 LDAP security
Time Limit The maximum number of seconds allowed to perform the
search. Specifying zero indicates that there is no time
limit.
Types Only This parameter has two possible values:
TRUE Only attribute descriptions are returned.
FALSE Attribute descriptions and values are
returned.
Search filter Specifies the criteria an entry must match to be returned
from a search. The search filter is a Boolean combination
of attribute value assertions. An attribute value assertion
tests the value of an attribute for equality, less than or
equal, and so on.
Attributes to return Specifies which attributes to retrieve from entries that
match the search criteria. Because an entry can have
many attributes, this allows the user to only see the
attributes in which they are interested.
Security is of great importance in the networked world of computers, and this is
true for LDAP as well. When sending data over insecure networks, internally or
externally, sensitive information might need to be protected during
transportation. There is also a need to know who is requesting the information
and who is sending it. This is especially important when it comes to the update
operations on a directory. RFC 4513 discusses the authentication methods and
security mechanisms available in LDAPv3, which can be divided into the
following sections:
Authentication Assurance that the opposite party (machine or person)
really is who he/she/it claims to be.
Integrity Assurance that the information that arrives is really the
same as what was sent.
Confidentiality Protection against information disclosure, by means of
data encryption, to those who are not intended to receive
it.
Authorization Assurance that a party is really allowed to do what it is
requesting to do, usually checked after user
authentication. Authorization is achieved by assigning
access controls, such as read, write, or delete, for user
IDs or common names to the resources being accessed.
Because these attributes are usually platform-specific,
LDAP does not provide specific controls. Instead, it has
Chapter 12. Directory and naming protocols 471