Naming and Directory Services (DNS, NIS, and LDAP)

proxy anonymous is a multi-valued entry, in that more than one credential level isdefined. A client assigned the proxy anonymous level will first attempt toauthenticate with its proxy identity. If the client is unable to authenticate as the proxyuser for whatever reason (user lockout, password expired, for example), then the clientwill use anonymous access. This might lead to a different level of service, dependingon how the directory is configured.Credential StorageIf you configure a client to use a proxy identity, the client saves its proxyDN andproxyPassword in /var/ldap/ldap_client_cred. For the sake of increasedsecurity, this file is restricted to root access only, and the value of proxyPassword isencrypted. While past LDAP implementations have stored proxy credentials in aclient’s profile, Solaris 9 LDAP naming services do not. Any proxy credentials setusing ldapclient during initialization are stored locally. This results in improvedsecurity surrounding a proxy’s DN and password information. See Chapter 12 formore information on setting up client profiles.Choosing Authentication MethodsWhen you assign the proxy or proxy-anonymous credential level to a client, youalso need to select a method by which the proxy authenticates to the directory server.By default, the authentication method is none, which implies anonymous access. Theauthentication method may also have a transport security option associated with it.The authentication method, like the credential level, may be multivalued. Forexample, in the client profile you could specify that the client first tries to bind usingthe simple method secured by TLS. If unsuccessful, the client would try to bind withthe sasl/digest-MD5 method. The authenticationMethod would then betls:simple;sasl/digest-MD5.LDAP naming services support some Simple Authentication and Security Layer(SASL) mechanisms. These mechanisms allow for a secure password exchangewithout requiring TLS. However, these mechanisms do not provide data integrity orprivacy. See RFC 2222 for information on SASL.The following authentication mechanisms are supported.■■noneThe client does not authenticate to the directory. This is equivalent to theanonymous credential level.simpleIf the client machine uses the simple authentication method, it binds to the serverby sending the user’s password in the clear. The password is thus subject tosnooping unless the session is protected by ipsec(7). The primary advantages ofusing the simple authentication method are that all directory servers support it144 System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP) • January 2005