Mac OS X Lion Server For Dummies®

Authenticating with LDAP and Kerberos

Directory services also provide the authentication that allows users to access other services. The common authentication backbones of many prevalent directories are Lightweight Directory Access Protocol (LDAP) and Kerberos. These two technologies are built into Apple Open Directory and Microsoft Active Directory. The descriptions here just scratch the surface of LDAP and Kerberos; for more information on each technology, see www.openldap.org and http://web.mit.edu/kerberos.

Although directory services facilitate user authentication through passwords, the passwords are not usually stored in directories. That's because anyone with access to the directory can usually browse its information. In Mac OS X Server, passwords can be stored either in the Open Directory Password Server database or in a Kerberos realm, which is a kind of holding place. When authenticating, Open Directory checks with the Kerberos realm first.

In Mac OS X Server, Open Directory never even reads the passwords. Each account password is stored as encrypted value called a shadow hash for each user. When the user submits a password for authentication, Open Directory runs it through the hash and compares the values of the hashes. If they match, the user is authenticated. Open Directory doesn't read the actual password.

When authenticating a user, Open Directory checks the user account stored in the directory to determine whether to use Kerberos authentication, the Password Server, ...