Re: storing ldap passwords on HSM
Michael Ströder wrote:
Howard Chu wrote:
> Given that Cyrus-SASL has a listmechs() API, I don't see why a client would
> ever have a hardcoded list of supported mechanisms.
Please re-read in my posting:
"At a minimum you have to register a new SASL mech as
being a password-based mech."
The SASL library provides its own prompts as well.
ldap_sasl_interactive_bind works without knowing anything about the
mechanism in advance.
Be assured that I really know what I'm talking about:
An interactive UI needs some extra effort.
You aren't the first or only person to have wrapped a GUI around a SASL
authentication.
https://git.gnome.org/browse/ekiga/tree/plugins/ldap/ldap-book.cpp
If your application requires updates every time a new loadable plugin is
released for one of its underlying libraries, you're just making things
harder on yourself.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/