Subject: FW: Digest auth the wrong solution?

From: "Jim Whitehead" <[email-masked]>
Date: Wed, 9 Oct 2002 17:04:10 -0700

Accidentally caught by the spam filter. I have added
<[email-masked]> to the accept2 list.

- Jim

-----Original Message-----
From: Daniel Stone [mailto:[email-masked]]
Sent: Wednesday, October 09, 2002 4:46 PM
To: [email-masked]
Subject: [Moderator Action] Digest auth the wrong solution?

Hi all,
I'm writing MoulDAVia, a Python-based WebDAV server. Basically, it has
interchangable backends for both authentication and retreiving/storing
files/properties; the end aim is to have the configurable per-location
(e.g. a shared area with no authentication and a home directory-based area
with LDAP auth, depending on path, etc).
Anyway, I've hit a bit of a snag trying to stay RFC-compliant: digest
authentication.
As far as I can tell, there's no real way to do digest authentication,
without knowing the password server-side. For the LDAP backend, which will
be the default (the default mode of operation will be home directories
until I get the whole per-location thing sorted), authentication is
performed by attempting to bind to LDAP as the given user/password pair,
and seeing if that succeeds or not. At no stage does the server know the
*real* password, only what the client gives it.
Which, as far as I can tell, leaves me in a bit of a quandary trying to
implement digest authentication. Is there any real way to do this without
knowing the passwords server-side?
I'm beginning to think that requiring digest auth is the wrong solution,
and requiring a method of authentication stronger than base64 (e.g. digest
or SSL), would be better. SSL isn't an issue to provide, but digest - now
that's a snag. :)
Any ideas?
-d

--
Daniel Stone                                <[email-masked]>
Developer, Trinity College, University of Melbourne

---

From: Murthy Chintalapati <[email-masked]>
Date: Wed, 09 Oct 2002 18:05:47 -0700

Daniel,

You are absolutely right in that the server-side need to know the real 
password to be able to the digest auth. However, this doesn't 
necessarily mean that the passwords are stored in clear text. For 
instance, LDAP servers (the Sun ONE Directory Server that I know for 
sure) support the notion of reversable password plugin -- where by 
server uses symmetric key algorithm (such as DES) to store password in 
an encrypted form.
regards.
-cvr

---

From: Daniel Stone <[email-masked]>
Date: Thu, 10 Oct 2002 19:34:23 +1000

> server uses symmetric key algorithm (such as DES) to store password in 

Hmm ... does OpenLDAP support this? That's what we're using, and we
would expect most implementations of MoulDAVia to be in
capital-F-Free/capital-O-Open environments, so I'm not too keen to
hobble it by restricting LDAP access to those with proprietary servers
... thanks for the heads-up!

> ><[email-masked]> to the accept2 list.

Cheers. :)