LDAP and Kebros

[Ragni Singh]

Hey all, what is what here. Whats the difference between the 2 and when would you use each one of those. What are you guys preference. ANy input is greatly appreciated. I need to convience my boss with one or the other.

POints will be assigned as always.

[Steven E. Protter · Accepted solution]

Shalom Sanjit,

LDAP is a authentication protocol that uses a lightweight database for user information. It supports easy integration across Unix, Windows, Linux. The security is good and it can work with Kerberos.

Kerberos is more on the encyption and security side. It is a way of exchanging encrypted information, including but not limited to authentication metod that involves the exchange of secure tickets. It is very safe, and you can actually use the two together.

LDAP is more widely used and is somewhat easier to integrate with windows. You can actually use LDAP to create an integrated, single sign on for Unix, Linux, Windows.

SEP

[Vitaly Karasik_1]

Exactly as SEP said, these two protocols may work together - in fact, MS windows domain uses both of them.
I suggest you to start with LDAP.
If you can describe your environment/requrements, it will help us to provide better answers.

[Andrew Cowan]

Sorry to SEP but I beg to differ here.

Kerberos was designed to remove the need to send clear text passwords or tokens over a network in order to authenticate a person or service, and also remove the need to have an explicit trust such as a "/.rhosts" file.

It is a common mistake to believe that a Kerberised service uses encrypted data, becuase although it can, it usually doesn't. When a service is Kerberised it simply means that it applies for a TGT (Ticket Granting Ticket) from a TGS (Ticket Granting Server), and this TGT iscan then produce a Service Ticket which is like a time-limited magic password that enables you to directly access another machine or service.
Once the connection is established, e.g. RSH, the data is completely unaltered, or protected, and can easily be read by a third party.

Kerberos is a good thing to use because it is a fairly efficient way to ensure that hosts and users are who they claim to be, and that you are not being spoofed.