Re: LDAP as password repository

From: Christopher Browne (cbbrowne_at_acm.org)
Date: 06/24/04 

Date: 24 Jun 2004 11:56:11 GMT

In the last exciting episode, dua12@yahoo.com (sunil Dua) wrote:
> I am working on the design of an application and was discussing
> passowrd storage and encryption with my team members. This application
> will use technologies like Java/Struts/JSP/Servlets/EJB. I have a
> thought that we can use LDAP for password storage and encryption
> instead of rewidning and incorporating of any new idea's.
>
> I was wondering if you Gurus see any problem in this idea as well any
> constraints which we might have to face in future.

The other two major options would be to:

 a) Use a relational database as password repository, e.g. PostgreSQL;

 b) Use an embedded database as password repository, e.g. Berkeley DB

> One more thing whihc I was wondering, will there be any performance
> related problem while users changes their password.

That's a major merit of going to a database system; the database
system should take on the relevant concurrency control, MASSIVELY
better than the text file approach.

No, I'd not expect there to be performance problems here. 

-- 
let name="cbbrowne" and tld="cbbrowne.com" in name ^ "@" ^ tld;;
http://www.ntlug.org/~cbbrowne/postgresql.html
To iterate is human; to recurse, divine.

Relevant Pages

  • Re: Newbie - Is this Reasonable?
    ... because this hash is stored in the database. ... So you use PKCS5v2 to generate a key hash from a salt and the user's passphrase, then store the salt and the hash in a database. ... are even more critical in database applications because the payoff from tampering with selected fields may be much higher, fields tend to be fixed-length so it's easier to tamper with them in a meaningful way, and databases lend themselves to off-line analysis, so the attacker can marshall more resources and take more time to attack your system. ... You're using a stream cipher for encryption. ...
    (sci.crypt)
  • 2005-Problem restoring database with encrypted columns to diff ser
    ... I need to start encrypting several fields in a database and have been doing ... OPEN MASTER KEY DECRYPTION BY PASSWORD = 'testAppleA3'; ... ALTER MASTER KEY ADD ENCRYPTION BY SERVICE MASTER KEY; ... encryption by certificate test; ...
    (microsoft.public.sqlserver.security)
  • Re: Protecting an Access Database
    ... because I want to make my database more secure. ... I see...So I guess that not even encryption (which I have ... I think Microsoft could have created a built-in encryption function within ...
    (microsoft.public.access.security)
  • Re: FlatFile Encryption using FILESTREAM
    ... If a folder on a domain contains confidential flat files, ... files can be added to a database filegroup and read using FILESTREAM. ... SQL Server ensures data-level consistency between the relational data in the ... "Note that this encryption is made by default when you create ...
    (microsoft.public.sqlserver.server)
  • Re: How to prevent importing tables
    ... why in-built encryption doesn't even matter if they otherwise have ... off-topic but is all to do with security and "extraction". ... > sufficient permission to open the database, ... then they don't even need to decrypt it! ...
    (microsoft.public.access.security)