is using LDAP or SESSION more secure for authentication and access control?

[Notgiven]

I am considering a large project and they currently use LDAP on MS platform.
It would be moved to a LAMP platform. OpenLDAP is an option though I have
not used it before. I do feel fairly confortable with my ability to use
SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as secure
authentication and access control using Sessions?

Thanks for your thoughts and experience.

[Erwin Moller]

Notgiven wrote:

I am considering a large project and they currently use LDAP on MS
platform. It would be moved to a LAMP platform. OpenLDAP is an option
though I have not used it before. I do feel fairly confortable with my
ability to use SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as
secure authentication and access control using Sessions?
Hi,

You better be the judge of that yourself.
Consider the following about sessions:

- A session with a client is based on some value that is passed to the
client. The client sends this value back each new request to the server.
- This is just a token, often in form of: PHPSESID=231jhg2fg14hg3ff43
- This sessionid is passed via cookie or URL

So untill now: Somebody has to intercept the sessionid on its route from
client to server and the other way round.
If somebody manages to do this, under most circumstances this bad guy can
'hijack the session', simply by going to the same page with the right
cookie set (for PHPSESSID)

If you can secure this part (by means of https eg) then you are fine (so
far).

How to use a session for security (admin-only pages example)

- A sessionid is used on the server to retrieve the actual data stored in
the session, like (in php):

to set some value:
$_SESSION["isadmin"] = "Y";

or on top of a script that demands admin-only entrance:
if ((isset($_SESSION["isadmin"]) && ($_SESSION["isadmin"] == "Y")) {
// OK
} else {
echo "Go away!";
exit;
}

So you'll have to adjust this logic everywhere in your application.
Next possible problem:

The server itself.
Consider where the sessiondata (like 'admin' value) is stored.
Default PHP install will use a filebased sessionstorage system.
It created a file in a temp directory under a name that includes the
sessionid.
PHP will get this file if a new request arives at the server.

Alternatively, you can write your own sessionhandling, and store it in a
database.

In both cases:
Ask yourself: Can somebody else get the session there? (in tempdirectory or
from database).

Remember that the tempdirectory is writable and readable for all users
(under most *nix distros).
The fileowner of the sessionfile will be the user that runs PHP.
Under *nix this is often www-data/apache/nobody.

So if you are in a shared hosting environment, somebody else running a
website on that machine, will run as the same user, thus will be able to
get the sessionfile and read/write it.
(Again under most setups)

Hope this helps you a bit to decide what is best.

Oh, my knowledge of LDAP is limited to 'heard that name before, something
with file/directorybased storage, right?'.
So I cannot help you compare.

Good luck.

Regards,
Erwin Moller

Thanks for your thoughts and experience.

[Notgiven]

"Erwin Moller"
<si******************************************@spam yourself.com> wrote in
message news:43***********************@news.xs4all.nl...

Notgiven wrote:

I am considering a large project and they currently use LDAP on MS
platform. It would be moved to a LAMP platform. OpenLDAP is an option
though I have not used it before. I do feel fairly confortable with my
ability to use SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as
secure authentication and access control using Sessions?

Hi,

You better be the judge of that yourself.
Consider the following about sessions:

- A session with a client is based on some value that is passed to the
client. The client sends this value back each new request to the server.
- This is just a token, often in form of: PHPSESID=231jhg2fg14hg3ff43
- This sessionid is passed via cookie or URL

So untill now: Somebody has to intercept the sessionid on its route from
client to server and the other way round.
If somebody manages to do this, under most circumstances this bad guy can
'hijack the session', simply by going to the same page with the right
cookie set (for PHPSESSID)

If you can secure this part (by means of https eg) then you are fine (so
far).

How to use a session for security (admin-only pages example)

- A sessionid is used on the server to retrieve the actual data stored in
the session, like (in php):

to set some value:
$_SESSION["isadmin"] = "Y";

or on top of a script that demands admin-only entrance:
if ((isset($_SESSION["isadmin"]) && ($_SESSION["isadmin"] == "Y")) {
// OK
} else {
echo "Go away!";
exit;
}

So you'll have to adjust this logic everywhere in your application.
Next possible problem:

The server itself.
Consider where the sessiondata (like 'admin' value) is stored.
Default PHP install will use a filebased sessionstorage system.
It created a file in a temp directory under a name that includes the
sessionid.
PHP will get this file if a new request arives at the server.

Alternatively, you can write your own sessionhandling, and store it in a
database.

In both cases:
Ask yourself: Can somebody else get the session there? (in tempdirectory
or
from database).

Remember that the tempdirectory is writable and readable for all users
(under most *nix distros).
The fileowner of the sessionfile will be the user that runs PHP.
Under *nix this is often www-data/apache/nobody.

So if you are in a shared hosting environment, somebody else running a
website on that machine, will run as the same user, thus will be able to
get the sessionfile and read/write it.
(Again under most setups)

Hope this helps you a bit to decide what is best.

Oh, my knowledge of LDAP is limited to 'heard that name before, something
with file/directorybased storage, right?'.
So I cannot help you compare.

Good luck.

Regards,
Erwin Moller

Thanks for your insight. I am using sessions for auth/acess control now for
several apps so. like you, I understand how that works. I haven't done this
yet, but you can set the session store location/directory in the php.ini
file.

If you do that and use SSL, I think most of session security is covered.
The logic of access control is critical and requires lots of planning and
"what-if" analysis.

thanks again!

[d]

"Notgiven" <no*********@invalid.invalid> wrote in message
news:L4**************@bignews4.bellsouth.net...

I am considering a large project and they currently use LDAP on MS
platform. It would be moved to a LAMP platform. OpenLDAP is an option
though I have not used it before. I do feel fairly confortable with my
ability to use SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as
secure authentication and access control using Sessions?

Thanks for your thoughts and experience.

I'd use LDAP. It will integrate directly with their domain controller (or
whatever is holding the directory), and save you lots of headache. You can
even use samba to act as a pam module, which you can use on linux to
authenticate users on a windows domain.

dave

[Gordon Burditt]

>I am considering a large project and they currently use LDAP on MS platform.

It would be moved to a LAMP platform. OpenLDAP is an option though I have
not used it before. I do feel fairly confortable with my ability to use
SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as secure
authentication and access control using Sessions?

This question seems a lot like "are you going to use roads or a
motor vehicle to go across town"? There's a good chance you will
want both.

LDAP as described here is functioning as a database of valid users
and passwords, and a method to check access. Alternatives might
include a MySQL database of users and passwords, a flat file, a
RADIUS server, or something hardcoded into code.

Issues like whether the passwords are encrypted when stored or
encrypted when transmitted are implementation details. If you want
it "secure", you have to describe the threat model. Is the problem
traffic sniffing? (encrypt passwords when transmitted) Or an
employee who walks off with a copy of the database (encrypt passwords
when stored). Sometimes it's not practical to do both.

You also need something that allows or disallows access to particular
pages. It also has the problem of grouping a set of accesses into
a "login session" as it is undesirable to make the user enter a
password on *every* page, and checking on every access can be
inefficient. PHP code with sessions is one way to do this. Apache
HTTP authentication is another (although it has disadvantages, like
not having a "logout" function). You can also use PHP code with
cookies. Or check IP addresses.

Gordon L. Burditt

[Notgiven]

"d" <[e-mail]> wrote in message
news:G6******************@text.news.blueyonder.co. uk...

"Notgiven" <no*********@invalid.invalid> wrote in message
news:L4**************@bignews4.bellsouth.net...

I am considering a large project and they currently use LDAP on MS
platform. It would be moved to a LAMP platform. OpenLDAP is an option
though I have not used it before. I do feel fairly confortable with my
ability to use SESSIONS for authentication and access control.

Would it better to learn and use LDAP or can you REALLY have just as
secure authentication and access control using Sessions?

Thanks for your thoughts and experience.

I'd use LDAP. It will integrate directly with their domain controller (or
whatever is holding the directory), and save you lots of headache. You
can even use samba to act as a pam module, which you can use on linux to
authenticate users on a windows domain.

dave

Thanks. This will be a standalone server not included in any domain.

[Notgiven]

> LDAP as described here is functioning as a database of valid users

and passwords, and a method to check access. Alternatives might
include a MySQL database of users and passwords, a flat file, a
RADIUS server, or something hardcoded into code.

Issues like whether the passwords are encrypted when stored or
encrypted when transmitted are implementation details. If you want
it "secure", you have to describe the threat model. Is the problem
traffic sniffing? (encrypt passwords when transmitted) Or an
employee who walks off with a copy of the database (encrypt passwords
when stored). Sometimes it's not practical to do both.

You also need something that allows or disallows access to particular
pages. It also has the problem of grouping a set of accesses into
a "login session" as it is undesirable to make the user enter a
password on *every* page, and checking on every access can be
inefficient. PHP code with sessions is one way to do this. Apache
HTTP authentication is another (although it has disadvantages, like
not having a "logout" function). You can also use PHP code with
cookies. Or check IP addresses.

So as I understand it, LDAP is an alternative to userid and passwords in a
database for authenticating.

Regarding sessions, right - I use them in my apps for controlling access to
certain pages.

Not being familiar with LDAP, I thought is was a magic bullet for
authenticating AND intra-application access control. I see not that it is
not. Rather, as I understand it, it is one of several authentication
methods.

Thanks again