Authen::SASL::Perl (3)
Leading comments
Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28) Standard preamble: ========================================================================
NAME
Authen::SASL::Perl -- Perl implementation of the SASL Authentication frameworkSYNOPSIS
use Authen::SASL qw(Perl);
$sasl = Authen::SASL->new(
mechanism => 'CRAM-MD5 PLAIN ANONYMOUS',
callback => {
user => $user,
pass => \&fetch_password
}
);
DESCRIPTION
Authen::SASL::Perl is the pure Perl implementation ofAt the time of this writing it provides the client part implementation for the following
- ANONYMOUS
-
The Anonymous SASLMechanism as defined inRFC 2245resp. inIETFDraft draft-ietf-sasl-anon-03.txt from February 2004 provides a method to anonymously access internet services.
Since it does no authentication it does not need to send any confidential information such as passwords in plain text over the network.
- CRAM-MD5
-
The CRAM-MD5 SASLMechanism as defined inRFC2195resp. inIETFDraft draft-ietf-sasl-crammd5-XX.txt offers a simple challenge-response authentication mechanism.
Since it is a challenge-response authentication mechanism no passwords are transferred in clear-text over the wire.
Due to the simplicity of the protocol
CRAM-MD5is susceptible to replay and dictionary attacks, soDIGEST-MD5should be used in preferrence. - DIGEST-MD5
-
The DIGEST-MD5 SASLMechanism as defined inRFC 2831resp. inIETFDraft draft-ietf-sasl-rfc2831bis-XX.txt offers theHTTPDigest Access Authentication asSASLmechanism.
Like
CRAM-MD5it is a challenge-response authentication method that does not send plain text passwords over the network.Compared to
CRAM-MD5, DIGEST-MD5prevents chosen plaintext attacks, and permits the use of third party authentication servers, so that it is recommended to useDIGEST-MD5instead ofCRAM-MD5when possible. - EXTERNAL
-
The EXTERNAL SASLmechanism as defined inRFC 2222allows the use of external authentication systems asSASLmechanisms.
- GSSAPI
-
The GSSAPI SASLmechanism as defined inRFC 2222resp.IETFDraft draft-ietf-sasl-gssapi-XX.txt allows using the Generic Security Service Application Program Interface [GSSAPI]KERBEROS V5as asSASLmechanism.
Although
GSSAPIis a general mechanism for authentication it is almost exlusively used for Kerberos 5. - LOGIN
-
The LOGIN SASLMechanism as defined inIETFDraft draft-murchison-sasl-login-XX.txt allows the combination of username and clear-text password to be used in aSASLmechanism.
It does does not provide a security layer and sends the credentials in clear over the wire. Thus this mechanism should not be used without adequate security protection.
- PLAIN
-
The Plain SASLMechanism as defined inRFC 2595resp.IETFDraft draft-ietf-sasl-plain-XX.txt is anotherSASLmechanism that allows username and clear-text password combinations inSASLenvironments.
Like
LOGINit sends the credentials in clear over the network and should not be used without sufficient security protection.
As for server support, only
"server_new"
- - no_integrity
- - no_confidentiality
which configures how the security layers are negotiated with the client (or rather imposed to the client).
SEE ALSO
Authen::SASL, Authen::SASL::Perl::ANONYMOUS, Authen::SASL::Perl::CRAM_MD5, Authen::SASL::Perl::DIGEST_MD5, Authen::SASL::Perl::EXTERNAL, Authen::SASL::Perl::GSSAPI, Authen::SASL::Perl::LOGIN, Authen::SASL::Perl::PLAINAUTHOR
Peter Marschall <peter@adpm.de>Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>