Enterprise Server integrates with LDAP servers to provide security using the MLDAP ESM Module, one of the available External Security Manager (ESM) modules for the External Security Feature (ESF). There are a number of ways that password-based authentication can be implemented using LDAP.
When the MLDAP ESM Module provides user authentication for Enterprise Server, it must verify the userid and password (sometimes referred to as credentials) supplied to ESF by an Enterprise Server component, and ultimately by the user. The module supports a variety of authentication processes, depending on its configuration.
Authentication in the MLDAP ESM Module is performed in one of two main ways:
Or:
The setting "mode" in the "[Verify]" section specified in the Configuration Information field determines which method is used. With the setting mode=MF-hash (the default), the module will retrieve the verifier from the LDAP repository and check it against the password, while the setting mode=bind instructs it to use the binding method.
In the MF-hash mode, each user object in the LDAP repository holds a password verifier string for that user. Typically, this is a salted cryptographic hash of the user's password. The module retrieves the verifier for the named user from the repository, computes a hash of the same type from the supplied password and the same salt as used in the verifier, and compares the result with the verifier. If they match, the password is correct.
Bind mode, on the other hand, asks the LDAP server to validate the user's credentials. An LDAP bind operation is equivalent to signing on to the LDAP server. The module makes a bind request using the supplied userid and password, and its success indicates the credentials were accepted by the LDAP server.
LDAP servers can delegate authentication to other systems. This is transparent to the MLDAP ESM Module.
Bind-mode verification is often useful where LDAP-server authentication is integrated into identity systems, or where the LDAP server is already used to authenticate users, and you would like to use existing user accounts and credentials as Enterprise Server users. However, this has certain disadvantages. As more processing is involved, Enterprise Server signons might be slower with bind-mode verification. Diagnostics are limited; the MLDAP ESM Module will often not be able to distinguish among different types of authentication failures (incorrect password, account locked out, and so on). And changing passwords is more complex and more likely to fail. See Changing passwords with the MLDAP ESM Module for more information.
The MLDAP ESM Module supports various types of password verifiers. Some of these are generated and processed by the module itself, in MF-hash mode. Others are created by or for the LDAP server when performing a password change in bind mode, and are processed (for authentication) by the LDAP server or some authentication system it uses.
It is not an error to configure a password-setting mode which does not correspond to the authentication mode, such as password type "AD" with MF-hash mode or password type "MF-A2" with bind mode. Nor is it an error to configure a password type which is not normally supported by the LDAP server, such as AD type with an OpenLDAP server. But such combinations generally are not useful. The administrator should ensure that the combination of authentication mode and password type are prudent.
The verifiers supported by the module in MF-hash mode are prefixed with a scheme name and a colon, followed by data, which can include parameters (such as salt) in addition to the verifier data proper.
The supported schemes include:
In MF-hash mode the password verifier is held in the microfocus-MFDS-User-Pwd attribute. Because each verifier specifies its type, different users can have verifiers of different types.
In bind mode, the actual verifier used by the LDAP server (or external identity system) is outside the scope of the MLDAP ESM Module. However, LDAP servers offer various mechanisms for setting passwords, and these are also treated as "password types" by the module. In some cases this "password type" can determine what type of verifier is stored by the LDAP server.
The supported mechanisms for setting passwords in LDAP servers are:
The MLDAP ESM Module can be configured to apply various constraints on new passwords when a password change is requested. These include minimum and maximum length, character sets (alphabetic, numeric, and so forth) and complexity, and password history. The password-history constraint relies on the module being able to save hashes of old passwords in the user object in LDAP, which is not always possible, depending on the LDAP server and security manager configurations.
These constraints are applied before attempting to change the password and apply to both authentication modes (MF-hash and bind) and all password types.
When an external password type is configured, the LDAP server can apply its own constraints. For example, with the AD password type, Active Directory will enforce all password constraints configured for the domain, such as complexity and password history.
LDAP servers or other security systems can impose other constraints beyond those configured by the administrator. For example, Active Directory usually only allows one password change every 24 hours for a given account.
There are various configuration options for the MLDAP ESM Module which affect password validation and password changes.
Password-related options in the [Passwords] section include:
Password-related options in the [Verify] section include:
See MLDAP ESM Module Custom Configuration Information for more information.