Normal Ldap Authentication - D-Link NetDefend DFL-210 User Manual

8.2.4. External LDAP Servers
A specific LDAP server that is defined in NetDefendOS for authentication can be shown with the
command:
gw-world:/> show LDAPDatabase <object_name>
The entire contents of the database can be displayed with the command:
gw-world:/> show LDAPDatabase
LDAP Authentication and PPP
When using a PPP based client for PPTP or L2TP access, special consideration has to be taken if
LDAP authentication is to succeed with CHAP, MS-CHAPv1 or MS-CHAPv2 encryption. The two
cases of (A) normal PPP authentication and (B) PPP with encyption are examined next.
A. Normal LDAP Authentication
Normal LDAP authentication for Webauth, XAuth, or PPP with PAP security is illustrated in the
diagram below. An authentication bind request with the username and password is sent to the LDAP
server which then performs the authentication and sends back a bind response with the result.
Figure 8.1. Normal LDAP Authentication
The processing is different if a group membership is being retrieved since a request is sent to the
LDAP server to search for memberships and any group memberships are then sent back in the
response.
B. PPP Authentication with CHAP, MS-CHAPv1 or MS-CHAPv2 Encryption
If PPP with CHAP, MS-CHAPv1 or MS-CHAPv2 is used for authentication, a digest of the user's
password will be sent to NetDefendOS by the client. NetDefendOS cannot just forward this digest
to the LDAP server since this won't be understood. The solution is for NetDefendOS to obtain the
password in plain-text from the LDAP server, create a digest itself, and then compare the created
digest with the digest from the client. If the two are the same, authentication is successful but it is
NetDefendOS that makes the authentication decision and not the LDAP server.
To retrieve the password from the LDAP server, two things are needed:
• The Password Attribute parameter needs to be specified when defining the server to
NetDefendOS. This will be the ID of the field on the LDAP server that will contain the
password when it's sent back.
325
Chapter 8. User Authentication