How The Directory Server Identifies Clients; How The Authentication Process Works - Netscape DIRECTORY SERVER 6.1 - PLUG-IN Manual

How the Directory Server Identifies Clients

SASL provides the means to use mechanisms other than simple authentication
and SSL to authenticate to the Directory Server.
How the Directory Server Identifies Clients
The server keeps track of the identity of the LDAP client through the
SLAPI_CONN_DN
During an LDAP bind operation, the server authenticates the user and puts the DN
and authenticated method in the
parameters.
When an authenticated client requests the server to perform an LDAP operation,
the server checks the DN in the
client has the appropriate access rights.

How the Authentication Process Works

When the Directory Server receives an LDAP bind request from a client, it
processes the request in the following steps:
The server parses the LDAP bind request and retrieves the following
1.
information:
If the method of authentication is
server also retrieves the name of the SASL mechanism used from the LDAP
bind request.
The server normalizes the DN retrieved from the request. (See the
2.
slapi_dn_normalize()
The server retrieves any LDAP v3 controls included with the LDAP bind
3.
request.
If the method of authentication is
4.
server determines whether or not the SASL mechanism (specified in the
request) is supported.
92 Netscape Directory Server Plug-In Programmer's Guide • August 2002
and
SLAPI_CONN_AUTHTYPE
The DN that the client is attempting to authenticate as
The method of authentication used
Any credentials (such as a password) included in the request
parameters.
and
SLAPI_CONN_DN
parameter to determine if the
SLAPI_CONN_DN
LDAP_AUTH_SASL
function for more information on normalized DNs.)
LDAP_AUTH_SASL
SLAPI_CONN_AUTHTYPE
(SASL authentication), the
(SASL authentication), the