Does LDAP provide a token after binding, so I don’t have to send credentials every time?

Question

I have a web application (PHP, but it does not matter). It uses LDAP for authentication (already running) and allows users to search for LDAP (already running).

But when searching, I use the general process account for bind (), and then run search ().

I would like to use the LDAP account that is logged in to be the same account that is being linked for the search. But the only way to do this is to save user credentials in sessions (bad!).

Brief description: is it possible to get "state / session / ??" token from LDAP, bind () and then search () for subsequent HTTP requests?

(btw using Active Directory.)

Answer 1

Basic LDAP does not provide anything like this. The credentials that you specify when binding are used for the rest of the connection, so if you can maintain an LDAP connection to multiple HTTP requests (and share LDAP connections among all the server jobs you run), you can avoid saving the credentials.

There are various extensions for LDAP floating around (including several in Active Directory), so it is possible that one of them adds sessions through connections, but if so, I don’t know about that.

As a workaround, since Active Directory supports GSSAPI and because of how Kerberos works, you should be able to use your user credentials to request a Kerberos ticket to access LDAP, and then save this ticket as your "state / session /? ? " marker. This Kerberos ticket will only be valid for LDAP access and will automatically expire, so this will avoid storing user credentials in the session. I do not know if your LDAP library supports GSSAPI and will give you enough control for this or not.