permanent ldap authenticated session - ldap

Question

I am trying to build a simple web based directory navigation/administration application.
Application requirements:
An Active Directory (or another directory service) domain user access
this web application and log in with the same domain user/password
credentials.
Then the user can navigate the directory tree, create/edit entries,
edit an entry's attribute, etc..
I'm using perl Net::LDAP for the ldap operations, as in:
#!/usr/bin/perl -wT
use Net::LDAP;
use CGI qw(:standard);
use CGI::Carp qw(warningsToBrowser fatalsToBrowser);
my $ssl = 1;
my $srv = '192.168.56.110';
my $uri = $ssl ? 'ldaps://' : 'ldap://';
my $c = Net::LDAP->new($uri . $srv) or
die "Unable to connect to server: $#\n";
# !!! This is a temporary workaround !!!
my $binddn = "cn=Administrator,cn=users,dc=example,dc=com";
my $passwd = "password";
my $mesg = $c->bind($binddn, password => $passwd);
die 'Unable to bind: ' . $mesg->error . "\n" if $mesg->code;
# DN to be deleted
my $dn = param('DN');
$mesg = $c->delete($dn);
die 'Error in delete: '. $mesg->error() ."\n" if $mesg->code();
$c->unbind;
I can call this cgi script with a HTML form, as in:
<form action="/cgi-bin/del.cgi" method="post">
<br>Peter Parker
<input type="radio" name="DN"
value="cn=peter parker,cn=users,dc=example,dc=com">
<br>Clark Kent
<input type="radio" name="DN"
value="cn=clark kent,cn=users,dc=example,dc=com">
<br>
<input type="submit" value="Delete User">
</form>
The problem with this code is that the ldap operations are using administrative credentials, not the credentials of the user running the web application. I'm using this workaround because I can't ask the user for his/her credentials every time.. and I don't know how to keep a user permanently authenticated.
My web application authenticate the user via ldap, asking he's credentials and issuing a bind request to the directory service, as in:
...
# read user supplied credentials
my $user_id = param('user_id');
my $password = param('password');
# now find the DN of user_id in directory
my $ssl = 1;
my $srv = '192.168.56.110';
my $uri = $ssl ? 'ldaps://' : 'ldap://';
my $c = Net::LDAP->new($uri . $srv) or
die "Unable to connect to server: $#";
# admin credentials are needed here to find the user DN
my $rootdn = "cn=Administrator,cn=users,dc=example,dc=com";
my $rootpw = "secret";
my $mesg = $c->bind($rootdn, password => $rootpw);
die "Unable to bind: ". $mesg->error if $mesg->code;
$mesg = $c->search(
base => 'dc=example,dc=com',
scope => 'sub',
filter => "(&(objectClass=user)(sAMAccountName=$user_id))",
attrs => ['sAMAccountName'],
);
die "Bad search: ". $mesg->error() if $mesg->code();
my ($entry) = $mesg->entries;
die "User not found: $user_id\n" unless $entry;
my $dn = $entry->dn;
# User DN found.. now check the credentials
$mesg = $c->bind($dn, password => $password);
die "Unable to bind: ". $mesg->error if $mesg->code;
$c->unbind();
# credentials validated!
print header, start_html('Welcome!'), h1('Hello, YOU!'), end_html;
After that, a cookie is sent to the user browser initiating a web session.
I could keep the user credentials in a database and then pass it to del.cgi (and other similar script) any time I needed.. but I don't think it's good security practice.
What can I do to keep a permanent ldap authenticated session as long as the web session is active?

Answer 1

There is no session. When an LDAP client connects to the directory server, the connection is unauthenticated. The bind request, should it be successful, establishes the authorization state of the connection. The connection remains in that authorization state until the next bind request, client disconnect, or server disconnect. Depending on the local setup, it may be possible to keep the connection open indefinitely with keep-alives or something similar. or the client can transmit another bind request periodically. Modern, professional-quality directory servers support disconnecting idle clients, or disconnecting clients after a certain period of time has passed, or after a set number of LDAP operations have been transmitted. Note that network administrators may disallow permanent connections for reasons of their own.
LDAP clients should check for response controls after the LDAP requests. Failure to check for response controls will result in the client missing important information from the server.
LDAP clients must be aware that the server can send an unsolicited notification in the form of an extended result. Failure to be handle the unsolicited notification can result in a badly behaved LDAP client. Most notifications are disconnect notifications, meaning the server is disconnecting the client for whatever reason.
Please see "LDAP: programming Practices" for more information.
Out of curiosity, why code such a thing? Apache Directory Studio is an excellent LDAP client.