search

etianen / django-python3-ldap

Django LDAP user authentication backend for Python 3.
BSD 3-Clause "New" or "Revised" License
411 stars 119 forks source link

Are passwords encrypted over the network if TLS is set to True? #116

Closed ghost closed 6 years ago

ghost commented 6 years ago

I have implemented this solution and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am attempting to decide between using this solution or Django's RemoteUserBackend. Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network. Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller?

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution?

etianen commented 6 years ago

If you are using an LDAPS server URL, or setting LDAP_AUTH_USE_TLS = True, the network password should be sent encrypted over the network.

Theoretically, both solutions should give you the same security. django-python3-ldap will give you better integration with the rest of your Django application. RemoteUserBackend with IIS has probably received more testing and auditing than django-python3-ldap.

On 2 February 2018 at 17:05, Cameron Taylor notifications@github.com wrote:

I have implemented this solution and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am attempting to decide between using this solution or Django's RemoteUserBackend. Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network. Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller?

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/116, or mute the thread https://github.com/notifications/unsubscribe-auth/AAJFCO0jWSJbjba5YDdXUImw6EWCwODMks5tQ0BrgaJpZM4R3fUN .

ghost commented 6 years ago

But that only encrypts the communication from web server to LDAPS server, correct? So HTTPS would be required to encrypt communication (including authentication creds) from browser to web server.

On Feb 5, 2018 6:29 AM, "Dave Hall" notifications@github.com wrote:

If you are using an LDAPS server URL, or setting LDAP_AUTH_USE_TLS = True, the network password should be sent encrypted over the network.

Theoretically, both solutions should give you the same security. django-python3-ldap will give you better integration with the rest of your Django application. RemoteUserBackend with IIS has probably received more testing and auditing than django-python3-ldap.

On 2 February 2018 at 17:05, Cameron Taylor notifications@github.com wrote:

I have implemented this solution and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am attempting to decide between using this solution or Django's RemoteUserBackend. Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network. Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller?

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/116, or mute the thread https://github.com/notifications/unsubscribe-auth/ AAJFCO0jWSJbjba5YDdXUImw6EWCwODMks5tQ0BrgaJpZM4R3fUN .

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/116#issuecomment-363058019, or mute the thread https://github.com/notifications/unsubscribe-auth/AcSYh4ulY2XWoYXg5CYfhGBzsoPtMGNRks5tRuYHgaJpZM4R3fUN .

etianen commented 6 years ago

Yes, to encrypt browser -> web server, you need HTTPS. That's the case whichever authentication backend you use.

On 5 February 2018 at 12:11, Cameron Taylor notifications@github.com wrote:

But that only encrypts the communication from web server to LDAPS server, correct? So HTTPS would be required to encrypt communication (including authentication creds) from browser to web server.

On Feb 5, 2018 6:29 AM, "Dave Hall" notifications@github.com wrote:

If you are using an LDAPS server URL, or setting LDAP_AUTH_USE_TLS = True, the network password should be sent encrypted over the network.

Theoretically, both solutions should give you the same security. django-python3-ldap will give you better integration with the rest of your Django application. RemoteUserBackend with IIS has probably received more testing and auditing than django-python3-ldap.

On 2 February 2018 at 17:05, Cameron Taylor notifications@github.com wrote:

I have implemented this solution and integrated AD with my Django project. The project will be hosted on IIS as an intranet site that is served solely over http. I am attempting to decide between using this solution or Django's RemoteUserBackend. Using RemoteUserBackend with IIS and enabling Windows Authentication prevents clear text passwords from being sent across the network. Is the same thing happening when I set LDAP_AUTH_USE_TLS = True and my LDAP_AUTH_URL is pointing to an LDAPS domain controller?

Is it more secure (all relative, I know) to use this solution or the IIS RemoteUserBackend solution?

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/116, or mute the thread https://github.com/notifications/unsubscribe-auth/ AAJFCO0jWSJbjba5YDdXUImw6EWCwODMks5tQ0BrgaJpZM4R3fUN .

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/ 116#issuecomment-363058019, or mute the thread https://github.com/notifications/unsubscribe-auth/ AcSYh4ulY2XWoYXg5CYfhGBzsoPtMGNRks5tRuYHgaJpZM4R3fUN .

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/etianen/django-python3-ldap/issues/116#issuecomment-363067101, or mute the thread https://github.com/notifications/unsubscribe-auth/AAJFCCmJQz58CFMSH2X-vXOGShyHEnX-ks5tRu_ZgaJpZM4R3fUN .