| Key: |
DIRSERVER-641
|
| Type: |
New Feature
|
| Status: |
Open
|
| Priority: |
Major
|
| Assignee: |
Unassigned
|
| Reporter: |
Ralf Hauser
|
| Votes: |
0
|
| Watchers: |
0
|
|
If you were logged in you would be able to see more operations.
|
|
|
|
Environment:
|
windows and linux
|
|
|
The ldap application we are working on has high security requirements, both in terms of "fine-grained"-policies we need to be able to implement as well as for the audit trail we must be able to provide.
For that, we should be able to distinguish/ensure/record in our authenticate() method
- whether the bind request was received unprotected or protected
- if with SSL protected, what session key was negotiated (if with 256+bit AES, client is entitled to see more than with 128 bit, let alone 40).
These give our application strong hints whether we must consider a credential (passwords in particular) compromised or not.
I assume this would either imply adding 1-2 more parameters to the method interface of
LdapPrincipal org.apache.directory.server.core.authn.AbstractAuthenticator.authenticate(ServerContext ctx)
or extending the ServerContext object correspondingly.
|
|
Description
|
The ldap application we are working on has high security requirements, both in terms of "fine-grained"-policies we need to be able to implement as well as for the audit trail we must be able to provide.
For that, we should be able to distinguish/ensure/record in our authenticate() method
- whether the bind request was received unprotected or protected
- if with SSL protected, what session key was negotiated (if with 256+bit AES, client is entitled to see more than with 128 bit, let alone 40).
These give our application strong hints whether we must consider a credential (passwords in particular) compromised or not.
I assume this would either imply adding 1-2 more parameters to the method interface of
LdapPrincipal org.apache.directory.server.core.authn.AbstractAuthenticator.authenticate(ServerContext ctx)
or extending the ServerContext object correspondingly. |
Show » |
| No work has yet been logged on this issue.
|
|
provide a security context to org.apache.directory.server.core.authn.AbstractAuthenticator.authenticate()
