Ldap query non-anonymous ?

IT here frowns on anonymous queries to LDAP. It appears that that is the only
way TS is able to verify passwords. Any way to get TS to use a specific
login/pw to query LDAP ?

Andy

Find more posts tagged with

Comments

Dwayne

Sounds like a case of RTFM

In my version of the admin guide, in the section labeled Configuring TeamSite and LDAP to Work Without an Anonymous Bind, it says to use

[authentication]
ldap_account=DistinguishedName
ldap_pwd=password

Current project: TS 5.5.2/6.1 W2K

nipper

I swear I did RTFM

TS 552 Solaris manual ?

nipper

How I missed that I have no friggin clue but I did,

Thanks Dwayne

Andy

(eating crow, but still padding my post totals)

patrickm

Does anyone know if it's possible to have this password encrypted in the iw.cfg file?

mstradling

I've not found any way built in to do this and have also looked at using the ldap_pam PAM module. From everything I could find this lets you store the password in a file called /etc/ldap.secret - but once again as plain text. The only protection on the file is chmodding it to 600.

I'm currently looking as another option, but still waiting for Interwoven to give me access to download the CSSDK (2 working days - yea, right).

My theory is that you could use the CSSDK to re-build the login page so the process runs as follows.
1) Encrypt the LDAP password using a known algorithm and add the encrypted password to iw.cfg in the usual place.
2) Inside the login page intercept the form submission, retrieve the (encrypted) LDAP password from iw.cfg, use the known algorithm to decrypt the LDAP password and then continue as usual.

This way the password in iw.cfg is encrypted, but it's plain text by the time TeamSite sends the request to the LDAP server.

One potential issue that I can see is that the call to the LDAP server is made using HTTP. If it's vanilla HTTP then the username/password are potentially exposed as plain text during transmission. The normal way to cover this is to transmit using HTTPS, but does TeamSite do this as a matter of course, or only if you are running everything over HTTPS.

If it uses the same protocol as the TeamSite server normally runs under, well lets see what come out of Johnny's "How to enable SSL just for the login page only?" thread.

Mark

[EDIT]
Well managed to get my hands on the CSSDK and, well, I'm a little under-welmed to be honest. Not much in there is there?

This solution is still an option though, it's just a matter of working out which classes/methods the Interwoven login GUI is calling and over-riding them where necessary.

I've not experienced any major objections to people doing this from Interwoven in the past, you just won't get any support on this part of your TeamSite system and Interwoven won't guarantee that the methods/classes you over-ride/extend/call will remain the same with future bug fixes, service packs and version upgrades (which is fair enough).
[/EDIT]

[EDIT 2]
Having taken another look at the ldap_pam module, this is released under the GNU Lesser General Public Licence. A quick scan suggests that that licence permits you to make modification to the source code for your own use (and distrbution under the same licence), so you could set an encrypted password in /etc/ldap.secret and modify the module to decrypt this value after it's read in.
[/EDIT 2]

Edited by mstradling on 01/26/06 05:55 AM (server time).