OS X Mountain Lion Server For Dummies

Authenticating with LDAP and Kerberos

Directory services also provide the authentication that allows users to access other services. The common authentication backbones of many prevalent directories are Lightweight Directory Access Protocol (LDAP) and Kerberos. These two technologies are built into Apple Open Directory and Microsoft Active Directory. The descriptions here just scratch the surface of LDAP and Kerberos; for more information on each technology, see www.openldap.org and http://web.mit.edu/kerberos.

Although directory services facilitate user authentication through passwords, the passwords are not usually stored in directories because anyone with access to the directory can usually browse its information. In OS X Server, passwords can be stored either in the Open Directory Password Server database or in a Kerberos realm, which is a kind of holding place. When authenticating, Open Directory checks with the Kerberos realm first.

In OS X Server, Open Directory never even reads the passwords. Each account password is stored as encrypted value called a shadow hash for each user. When the user submits a password for authentication, Open Directory runs it through the hash and compares the values of the hashes. If they match, the user is authenticated. Open Directory doesn’t read the actual password.

LDAP

In most modern network directories, LDAP defines how clients communicate with the directory over TCP/IP networks. Computers use LDAP to read and edit information in LDAP-compatible ...