ldap vs kerberos authentication for idpv3

[Bellina, Brendan]

Most directory servers should allow you to define an attribute as case
sensitive and to restrict matching based on that. I do not know why you
would really want to do that since from a user’s perspective it is
unlikely that they would expect user id’s to be case sensitive just as
email addresses are not.  But it should be possible.

Not sure about the white space.

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA
✉ bbellina at ucla.edu   ☏ +1 310 206 3131






On 2/8/16, 12:01 PM, "users on behalf of Paul B. Henson"
<users-bounces at shibboleth.net on behalf of henson at cpp.edu> wrote:

>We are finally getting around to working on upgrading to idp v3 (too much
>to do, too few resources, I'm sure many educational institutions can
>sympathize <sigh>), and I was curious how many sites authenticate via
>ldap compared to how many authenticate via kerberos?
>
>When we originally deployed idpv2, we went with ldap authentication, as
>all of our attributes were in our openldap directory and it seemed the
>simplest thing to do. I've never really like using ldap for
>authentication, while it is a great source of authorization, it has
>always seemed a stretch to consider it an authorization source. It has a
>number of characteristics that make it annoying as an authorization
>source, such as its lack of case sensitivity, it will happily
>authenticate a mixed case UsERNAme, as well as one with leading or
>trailing white space, which really confuses an underlying application. We
>worked around that in idpv2 with client-side JavaScript on the login
>page, I'm not sure if there was a better way in v2 or is a better way in
>v3. In any case, we also have a heavily used kerberos deployment on
>campus that is the authentication back end for our unix systems and our
>secure nfs deployment. Particularly given I see that SPNEGO is supported
>in idpv3 I'm seriou!
> 
> sly consi
> dering switching to kerberos for idpv3 and just using ldap for
>attributes, not authentication.
>
>But before I did, I thought I'd just see how many people were, and how
>well it was working for them, and if there were any caveats or concerns I
>should take into consideration before moving forward with it.
>
>Thanks much...
>
>--
>Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
>Operating Systems and Network Analyst  |  henson at cpp.edu
>California State Polytechnic University  |  Pomona CA 91768
>
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net