Active Directory as Authentication Source

[Cantor, Scott]

On 3/4/15, 6:02 PM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:


>
>> (2) Should I be looking at treating authentication to an AD server more 
>>like a
>> Kerberos authentication scheme rather than an LDAP type scheme.
>
>I would advise against it, it just opens a completely different can of 
>worms with the principal being not what you expected.

I'd say the opposite, because it's just the right tool for the job. LDAP 
is not an authentication protocol, and Kerberos is much, much faster and 
more reliable in most cases. And I think it's evil for users to support 
alternate usernames, and that makes your resolver config more painful 
anyway.

But that assumes your principal names in AD are in fact what you want. If 
they're not, you're obviously stuck, but it's easy to check.

Kerberos config on the IdP side is also just drastically easier, though 
that's mostly because Sun's Kerberos module doesn't do KDC spoof checking 
so there's no service principal/keytab.

-- Scott