HP-UX Directory Server 8.1 plug-in reference

8 Defining functions for authentication
This chapter explains how to write a plug-in function to bypass or replace the standard function
for authentication with your own function.
8.1 Understanding authentication methods
Authentication methods for LDAP is described in RFC 2829, which you can find at http://
www.ietf.org/rfc/rfc2251.txt
Two methods that you can use to authenticate clients are simple authentication and SASL
authentication:
• Simple authentication is described in RFC 2251, which you can find at http://www.ietf.org/
rfc/rfc2251.txt
Simple authentication provides minimal facilities for authentication. In the simple
authentication method, clients send a DN and password to the server for authentication.
The server compares the password sent by the client against the password stored in the
client's directory entry.
• Simple Authentication and Security Layer (SASL) is described in RFC 2222, which you can
find at http://www.ietf.org/rfc/rfc2222.txt
SASL provides the means to use mechanisms other than simple authentication and SSL to
authenticate to the Directory Server.
8.2 How the Directory Server identifies clients
The server keeps track of the identity of the LDAP client through the SLAPI_CONN_DN and
SLAPI_CONN_AUTHTYPE parameters.
During an LDAP bind operation, the server authenticates the user and puts the DN and
authenticated method in the SLAPI_CONN_DN and SLAPI_CONN_AUTHTYPE parameters.
When an authenticated client requests the server to perform an LDAP operation, the server
checks the DN in the SLAPI_CONN_DN parameter to determine if the client has the appropriate
access rights.
8.3 How the authentication process works
When the Directory Server receives an LDAP bind request from a client, it processes the request
as follows:
Procedure 8-1 How an authentication request is processed
1. The server parses the LDAP bind request and retrieves the following information:
• The DN as which the client is attempting to authenticate.
• The method of authentication used.
• Any credentials (such as a password) included in the request.
If the method of authentication is LDAP_AUTH_SASL (SASL authentication), the server also
retrieves the name of the SASL mechanism used from the LDAP bind request.
2. The server normalizes the DN retrieved from the request. (Refer to the slapi_sdn_get_ndn()
function for more information on normalized DNs.)
3. The server retrieves any LDAPv3 controls included with the LDAP bind request.
8.1 Understanding authentication methods 69