Data Connector Depending on Attributes

[Cantor, Scott]

On 2/3/16, 9:01 PM, "users on behalf of Nate Klingenstein" <users-bounces at shibboleth.net on behalf of nate.klingenstein at utah.edu> wrote:



>> No, but it's LDAP's problem to sanitize its inputs, not the client's.
>
>One more question, then.  Is that also so for other data sources or protocols that may be used in authentication, such as SQL?  I know it’s a potentially inexhaustible list, but just the three or so people ask about here; LDAP, Kerberos, SQL, and so forth.

Kerberos clients are involved in parsing a principal name you give it, and they're pretty strict from what I've seen.


The usual defense in a SQL login is to make sure the connection is read-only, but we don't provide any SQL authentication support either.

-- Scott

>