What is SASL, and why does LDAP use it for authentication?
SASL (Simple Authentication and Security Layer, RFC 4422) is a framework that separates an application protocol from its authentication mechanisms, so LDAP can use passwords, Kerberos or certificates by naming a mechanism instead of changing the protocol.
Without SASL, every new login method would need a change to the LDAP bind operation. With SASL, the bind just says "I use mechanism X" and then carries that mechanism's messages back and forth. Common mechanisms:
| SASL mechanism | Proof of identity |
|---|---|
GSSAPI |
A Kerberos service ticket: single sign-on to the directory |
EXTERNAL |
An identity already established outside, typically a TLS client certificate |
SCRAM-SHA-256 |
A password, via a challenge-response that never sends it in clear |
PLAIN |
User name and password in clear (only acceptable inside TLS) |
Some mechanisms can also negotiate a security layer (integrity or encryption of the following LDAP traffic), which is the "security layer" in the name. The same SASL framework is reused by other protocols such as SMTP, IMAP and XMPP.
Go deeper:
Simple Authentication and Security Layer (Wikipedia) — the framework and the list of registered mechanisms.- OpenLDAP Admin Guide: Using SASL — configuring GSSAPI (Kerberos) and other mechanisms on a real server.