ldap vs kerberos authentication for idpv3

[Paul B. Henson]

We are finally getting around to working on upgrading to idp v3 (too much to do, too few resources, I'm sure many educational institutions can sympathize <sigh>), and I was curious how many sites authenticate via ldap compared to how many authenticate via kerberos?

When we originally deployed idpv2, we went with ldap authentication, as all of our attributes were in our openldap directory and it seemed the simplest thing to do. I've never really like using ldap for authentication, while it is a great source of authorization, it has always seemed a stretch to consider it an authorization source. It has a number of characteristics that make it annoying as an authorization source, such as its lack of case sensitivity, it will happily authenticate a mixed case UsERNAme, as well as one with leading or trailing white space, which really confuses an underlying application. We worked around that in idpv2 with client-side JavaScript on the login page, I'm not sure if there was a better way in v2 or is a better way in v3. In any case, we also have a heavily used kerberos deployment on campus that is the authentication back end for our unix systems and our secure nfs deployment. Particularly given I see that SPNEGO is supported in idpv3 I'm seriously considering switching to kerberos for idpv3 and just using ldap for attributes, not authentication.

But before I did, I thought I'd just see how many people were, and how well it was working for them, and if there were any caveats or concerns I should take into consideration before moving forward with it.

Thanks much...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768