TCP/IP Tutorial and Technical Overview - IBM Redbooks

472 TCP/IP Tutorial and Technical Overview
built-in mechanisms to allow the use of the
platform-specific controls.
Because the use of authorization controls is platform-specific, the following
sections describe only the authentication, integrity, and confidentiality. There are
several mechanisms that can be used for this purpose; the most important ones
are discussed here. These are:
► No authentication
► Basic authentication
► Simple Authentication and Security Layer (SASL)
► Transport Layer Security (TLS)
The security mechanism to be used in LDAP is negotiated when the connection
between the client and the server is established.
No authentication
No authentication should only be used when data security is not an issue and
when no special access control permissions are involved. This might be the
case, for example, when your directory is an address book browsable by
anybody. No authentication is assumed when you leave the password and DN
field empty in the bind API call. The LDAP server then automatically assumes an
anonymous user session and grants access with the appropriate access controls
defined for this kind of access (not to be confused with the SASL anonymous
user discussed in “Simple Authentication and Security Layer (SASL)”).
Basic authentication
Basic authentication is also used in several other Web-related protocols, such as
HTTP. When using basic authentication with LDAP, the client identifies itself to
the server by means of a DN and a password, which are sent in the clear over
the network (some implementations might use Base64 encoding instead). The
server considers the client authenticated if the DN and password sent by the
client matches the password for that DN stored in the directory. Base64 encoding
is defined in the Multipurpose Internet Mail Extensions, or MIME (see 15.3,
“Multipurpose Internet Mail Extensions (MIME)” on page 571). Base64 is a
relatively simple encryption, and it is not hard to break after the data has been
captured in the network.
Simple Authentication and Security Layer (SASL)
SASL is a framework for adding additional authentication mechanisms to
connection-oriented protocols, and is defined in RFC 4422. It has been added to
LDAPv3 to overcome the authentication shortcomings of Version 2. SASL was
originally devised to add stronger authentication to the IMAP protocol (see 15.5,