Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY CUSTOMIZATION, Manual

Page: 92 / 612

How the Directory Server Identifies Clients
92 Netscape Directory Server Plug-In Programmer’s Guide • December 2003
• Simple Authentication and Security Layer (SASL) is described in RFC 2222,
which you can find at this location:
http://www.ietf.org/rfc/rfc2222.txt
SASL provides the means to use mechanisms other than simple authentication
and SSL to authenticate to the Directory Server.
How the Directory Server Identifies Clients
The server keeps track of the identity of the LDAP client through the
SLAPI_CONN_DN
and
SLAPI_CONN_AUTHTYPE
parameters.
During an LDAP bind operation, the server authenticates the user and puts the DN
and authenticated method in the
SLAPI_CONN_DN
and
SLAPI_CONN_AUTHTYPE
parameters.
When an authenticated client requests the server to perform an LDAP operation,
the server checks the DN in the
SLAPI_CONN_DN
parameter to determine if the
client has the appropriate access rights.
How the Authentication Process Works
When the Directory Server receives an LDAP bind request from a client, it
processes the request in the following steps:
1.
The server parses the LDAP bind request and retrieves the following
information:
❍
The DN that the client is attempting to authenticate as
❍
The method of authentication used
❍
Any credentials (such as a password) included in the request
If the method of authentication is
LDAP_AUTH_SASL
(SASL authentication), the
server also retrieves the name of the SASL mechanism used from the LDAP
bind request.
2.
The server normalizes the DN retrieved from the request. (See the
slapi_dn_normalize()
function for more information on normalized DNs.)
3.
The server retrieves any LDAP v3 controls included with the LDAP bind
request.