Subject: Re: unauthenticated bind

From: "Roger Harrison" <[email-masked]>
Date: Thu, 13 Nov 2003 07:09:17 -0700

Here's my proposal:

in Section 6.1 (Anonymous Authentication)

"An LDAP client may also explicitly establish an anonymous association.
A client that wishes to do so MUST choose the simple authentication
option in the Bind Request and set the password to be of zero length.
Typically the name is also of zero length. A bind request where both the
name and password are of zero length is said to be an anonymous bind. A
bind request where the name, a DN, is of non-zero length, and the
password is of zero length is said to be an unauthenticated bind. Both
variations produce an anonymous association. 

"Unauthenticated binds can have significant security issues (see
section 10). Servers SHOULD by default reject unauthenticated bind
requests, and clients may need to actively detect situations where they
would make an unauthenticated bind request."

in Section 10 (security considerations):

"Operational experience shows that clients can (and frequently do)
misuse unauthenticated bind (see section 6.1).  For example, a client
program might make a decision to grant access to non-directory
information on the basis of completing a successful bind operation. Some
LDAP server implementations will return a success response to an
unauthenticated bind thus leaving the client with the impression that
the server has successfully authenticated the identity represented by
the user name, when in reality, the server has simply performed an
anonymous bind.  For this reason, servers SHOULD by default reject
authentication requests that have a DN with an empty password with an
error of invalidCredentials. Clients that use the results from a simple
bind operation to make authorization decisions should actively detect
unauthenticated bind requests (via the empty password value) and react
appropriately."

Roger

>>> "Mark Smith" <[email-masked]> 11/12/2003 11:00:31 AM >>>
Jim Sermersheim wrote on 11/12/2003, 10:27 AM: 
Disallowing them completely may break some current client and server
implementations. I remember some people (maybe Mark Smith) from Netscape
saying that they use the mechanism as some way of voluntary auditing or
some such.
Yes, people do use it that way... I am not saying this is a great LDAP
feature from a security point of view though.

I prefer the compromise solution brought up in yesterday's meeting
where part of the note is moved into the main body of the document with
a pointer to the security considerations which contains the reasons
why.
That sounds OK although I'll have to see the exact proposal.

-Mark

---

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 14 Nov 2003 20:54:25 +0100

> option in the Bind Request and set the password to be of zero length.

Why forbid the SASL method ANONYMOUS (draft-ietf-sasl-anon-02.txt)?

Besides, as I mentioned in my authmeth-07 issues message, I think it is
better to avoid the MUST by formulating this as

  A client can explicitly establish an anonymous association
  by sending a Bind Request with a zero length password.

> Typically the name is also of zero length.

Drop this, it's implied by the SHOULD below.

> would make an unauthenticated bind request."

..."instead of a Simple Bind with a password".

> Some
> anonymous bind.

s/anonymous bind/unauthenticated bind/.  Unless you revise the suggested
definition of anonymous binds in 6.1 to say that an unauthenticated bind
is one kind of anonymous bind.

> For this reason, servers SHOULD by default reject
> error of invalidCredentials.

Move "with an error of invalidCredentials" to 6.1.  And maybe reword the
rest to 'This is why servers should by default reject...', since the
SHOULD has already been stated in 6.1.

-- 
Hallvard