Download the JDK
Search the Tutorials
Hide the TOC
Trail: Java Naming and Directory Interface(TM).
Lesson: Advanced Topics for LDAP Users
Section: Security
Advanced Topics for LDAP Users
LDAP v3
JNDI as an LDAP API
How LDAP Operations Map to JNDI APIs
How LDAP Error Codes Map to JNDI Exceptions
Security
Modes of Authenticating to LDAP
Authentication Mechanisms
Anonymous
Simple
SASL
Digest-MD5
SSL and Custom Sockets
More LDAP Operations
LDAP Compare
Search Results
LDAP Unsolicited Notifications
Connection Management
Creation
Closing
Pooling
Configuration
Frequently Asked Questions
Home Page > Java Naming and Directory Interface(TM). > Advanced Topics for LDAP Users
Authentication Mechanisms

> Different versions of the LDAP support different types of authentication. The LDAP v2 defines three types of authentication: anonymous, simple (clear-text password), and Kerberos v4.

> The LDAP v3 supports anonymous, simple, and SASL authentication. SASL is the Simple Authentication and Security Layer (RFC 2222). It specifies a challenge-response protocol in which data is exchanged between the client and the server for the purposes of authentication and establishment of a security layer on which to carry out subsequent communication. By using SASL, the LDAP can support any type of authentication agreed upon by the LDAP client and server.

> This lesson contains descriptions of how to authenticate by using anonymous, simple, and SASL authentication.

> #### Specifying the Authentication Mechanism

> The authentication mechanism is specified by using the `Context.SECURITY_AUTHENTICATION` environment property. The property may have one of the following values.

> sasl_mech | A space-separated list of SASL mechanism names. Use one of the SASL mechanisms listed (e.g., `"CRAM-MD5"` means to use the CRAM-MD5 SASL mechanism described in RFC 2195).
> `none` | Use no authentication (anonymous)
> `simple` | Use weak authentication (clear-text password)

> #### The Default Mechanism

> If the client does not specify any authentication environment properties, then the default authentication mechanism is `"none"`. The client will then be treated as an anonymous client.

> If the client specifies authentication information without explicitly specifying the `Context.SECURITY_AUTHENTICATION` property, then the default authentication mechanism is `"simple"`.

Previous page: Modes of Authenticating to LDAP
Next page: Anonymous