RFC6331: Moving DIGEST-MD5 to Historic

[Neustradamus]

Dear @flamencist,

In first, I wish you a Happy New Year!

20 November 2008: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-ietf-sasl-crammd5-to-historic-00

29 June 2017: CRAM-MD5 to Historic:

• https://tools.ietf.org/html/draft-zeilenga-luis140219-crammd5-to-historic-00

July 2011: RFC6331: Moving DIGEST-MD5 to Historic:

• https://tools.ietf.org/html/rfc6331

August 2021: RFC9051: Internet Message Access Protocol (IMAP) - Version 4rev2:
"Replaced DIGEST-MD5 SASL mechanism with SCRAM-SHA-256. DIGEST-MD5 was deprecated."

• https://tools.ietf.org/html/rfc9051

I add same about SCRAM-MD5.

There are now:

• July 2010: RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM): SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 (SCRAM-SHA-1 and SCRAM-SHA-1-PLUS)
• July 2010: RFC5803: Lightweight Directory Access Protocol (LDAP) Schema for Storing Salted: Challenge Response Authentication Mechanism (SCRAM) Secrets: https://tools.ietf.org/html/rfc5803
• November 2015: RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS: Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677

Soon:

• SCRAM-SHA-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha-512
• SCRAM-SHA3-512(-PLUS): https://tools.ietf.org/html/draft-melnikov-scram-sha3-512

[flamencist]

Hi! You are welcome! The library is based on openldap native library for unix systems and wldap for windows. Need detailed investigating about supporting scram in these libraries

[Neustradamus]

@flamencist: Thanks for your quick reply!
It is linked to the request of SCRAM supports, more details here: #142 and there is a link to a list of libs/softs already compatible.

@quanah: Happy New Year, can you do a perfect answer from a member of the OpenLDAP team about SCRAM possibilities because it is not clear in the website which need an update: https://www.google.com/search?q=site%3Aopenldap.org+SCRAM.

It is a little better for Cyrus: https://www.google.com/search?q=site%3Acyrusimap.org+SCRAM.

Thanks in advance.

[Neustradamus]

Dear @quanah: You have forgotten to reply to @flamencist.

Maybe other members of the @openldap team can reply?

Thanks in advance.

[quanah]

@Neustradamus OpenLDAP uses cyrus-sasl for SASL mechanisms, not sure that OpenLDAP needs to do anything here.

[flamencist]

The library uses SASL interaction via the OpenLDAP native method ldap_sasl_interactive_bind_s https://man7.org/linux/man-pages/man3/ldap_unbind_s.3.html
Looks like the openldap uses directly sasl_client_start fo mechs https://github.com/winlibs/openldap/blob/2615a35b32b3596a1e8f872f0c244bc4a41a047e/libraries/libldap/cyrus.c#L501

Anyway I need some help to set the correct mechanism for new types of auth

[aamelnikov]

SCRAM is a part of Cyrus SASL, so I think it should just work with ldap_sasl_interactive_bind_s out of the box. I am certainly able to use SCRAM in LDAP using OpenLDAP in the code I write for my employer.