Re: External LDAP Authentication through the firewall

["Flynn, Gerald" <flynngn () JMU EDU>]

> -----Original Message-----
> From: The EDUCAUSE Security Constituent Group Listserv
> [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Di Fabio, Andrea
> Sent: Friday, January 08, 2010 9:28 AM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] External LDAP Authentication through the firewall
>
> I'd like to get some feedback on the pros and cons of allowing a vendor
> to
> directly query the internal LDAP for user authentication.  I do
> understand
> that there tools out there like shibboleth, but at this point we have
> gotten a
> specific request to allow AD authentication through our firewall for an
> InterLibrary Loan Software.  Save the: it should have been a well
> thought out
> process/project comments ;-)  Sometimes we can control what other IT
> units do.
>
> The MS LDAP is our main and central authentication and GP.  I am
> inclined to
> deny the request, but I would like to bounce it against you experts and
> possibly get some points for or against it that I can use when
> responding to
> the Library IT person and possibly to upper management.
>
> Thank you!

We have to this point refused such requests for a variety of reasons:

1) Don't want to encourage people to provide JMU eID/passwords to
   third parties or type them into third party sites. Want to be 
   consistent in policies and practice.
2) Don't want to risk JMU eID/passwords being compromised either 
   accidently or intentionally in third party servers and networks.
3) Don't want to give third parties access to the large number of
   unrelated services, applications, and data sets that LDAP 
   credentials provide access to. Both from a liability standpoint and 
   on general principle of protecting university and constituent assets 
   from unauthorized access.
4) Don't want to risk information leakage (particularly with MS AD)
   or enable information harvesting.
5) Don't want to expose the general attack surface outside the
   campus border.
6) Want to encourage vendors to design responsible architectures
   more suitable for their customers and purpose.

Note that if users can be convinced to provide university credentials
to third parties, the third parties can simple pass along those
credentials to any internet exposed, LDAP authenticated university
resource to achieve the same ends. If the university blesses providing
university credentials to one third party, things could get out
of hand quickly trying to explain to users when its appropriate and
when it's not. In my mind, allowing such activity is just asking for
things to spiral out of control and turns control of all LDAP
authenticated services over to third parties.


Gary Flynn
Security Engineer
James Madison University