Lightweight Directory Access Protocol Research Articles

Security Analysis of Web Open-Source Projects Based on Java and PHP

During website development, the selection of suitable computer language and reasonable use of relevant open-source projects is imperative. Although the two languages, PHP and Java, have been extensively investigated in this context, there are not many security test reports based on their open-source projects. In this article, we conducted separate security analyses on web-related open-source projects based on PHP and Java. To this end, different open-source frameworks and services are used to design websites used to test experimental attacks on 12 popular open-source filters available on GitHub, as well as investigate the use of Lightweight Directory Access Protocol (LDAP) in the Firefox browser environment. Using malicious payloads published by Open Web Application Security Project (OWASP) and others, Cross-site Scripting (XSS), Local File Inclusion (LFI), SQL injection, and LDAP injection are performed on the test targets. The experimental results reveal that although PHP-based open-source projects are more vulnerable to attacks than Java-based ones, there is significant room for improvement. Finally, a whitelist-based filtering scheme is proposed. This scheme filters the inline attributes of label elements so that the filter has an excellent detection rate of malicious payloads while having an excellent pass rate of benign payloads. Effective references and suggestions for web developers are also included to aid the selection of open-source web projects, and feasible solutions to improve filter performance are proposed.

Review Paper on the Light Weight Directory Access Protocol

External LDAP directories currently use directory servers such as MS Active Directory, OpenLDAP, OpenDJ, etc. to store user, group, and authorization information and then provide that information organization's enterprise applications. This is considered a standard technique. Most organizations prefer external LDAP because the authentication protocol is very simple. The proposed system uses an external Lightweight Directory Access Protocol (LDAP) to manage and authenticate user information inside and outside the organization. This external LDAP directory stores various user information. This information can be later retrieved by other users, depending on their access level. Various applications also use this technology to ensure that authenticated users provide correct authentication data. This data must match the information stored on your LDAP server.

Centralized and Decentralized Distributed Energy Resource Access Control Implementation Considerations

A global transition to power grids with high penetrations of renewable energy generation is being driven in part by rapid installations of distributed energy resources (DER). New DER equipment includes standardized IEEE 1547-2018 communication interfaces and proprietary communications capabilities. Interoperable DER provides new monitoring and control capabilities. The existence of multiple entities with different roles and responsibilities within the DER ecosystem makes the Access Control (AC) mechanism necessary. In this paper, we introduce and compare two novel architectures, which provide a Role-Based Access Control (RBAC) service to the DER ecosystem’s entities. Selecting an appropriate RBAC technology is important for the RBAC administrator and users who request DER access authorization. The first architecture is centralized, based on the OpenLDAP, an open source implementation of the Lightweight Directory Access Protocol (LDAP). The second approach is decentralized, based on a private Ethereum blockchain test network, where the RBAC model is stored and efficiently retrieved via the utilization of a single Smart Contract. We have implemented two end-to-end Proofs-of-Concept (PoC), respectively, to offer the RBAC service to the DER entities as web applications. Finally, an evaluation of the two approaches is presented, highlighting the key speed, cost, usability, and security features.

Online Examination System

Abstract: The online Examination portal is a web-based application for technical evaluation. The online examination portal not only replaces paperwork but also releases the workload of faculty. Most of the e-examination (Online Examinations) have fixed number of questions without randomizations, they have pool scalability. Online examination system is increasing rapidly with the change in scenario due to the pandemic, also it seems to be an easy, flexible, and secure methodology to carry the examinations effectively. Keywords: RDBMS- Relational Database Management System, LDAP- Lightweight Directory Access Protocol, SRS-Software Requirement Specification, DFD- Data Flow Diagram, GPL- General Public License

INTEGRATION OF APPLICATION LAYER SERVICES WITH CENTRAL AUTHENTICATION SERVER IN EXAMPLE OF HTTP AND FTP RESTRICTION

Nowadays it is very important to have an authenticated and secure network. hackers are always one step further and try to steal credentials or doing malicious actions. Many organizations implement strong authentication systems for taking drastic security measures to prevent threats and vulnerabilities. This paper describes integration of application layer services with central authentication server called Lightweight Directory Access Protocol(LDAP), it covers detailed mechanism to control and restrict any software application or network services which may implement and require central authentication protocols including web (eg: HTTP protocol) and file transfer protocol (eg: FTP protocol). This will enable authenticated web and ftp webpage for reliability and security. The authentication services also provide Ubuntu client domain join and network authentication to enable integrity and authentication across the network. This paper is conducted through deep library research and practical implementation of the services.The goal of this paper is to introduce a unified secure centralized authentication system to authenticate and grant the authorized users to have access to the restricted Kerberized services in a period of time which is granted. It provides more trust, secure environment, but less traffic and others` interference

Systematic Literature Review on the LDAP Protocol As a Centralized Mechanism for the Authentication of Users in Multiple Systems

.

Identity and Access Management System: a Web-Based Approach for an Enterprise

Managing digital identities and access control for enterprise users and applications remains one of the greatest challenges facing computing today. An attempt to address this issue led to the proposed security paradigm called Identity and Access Management (IAM) service based on IAM standards. Current approaches such as Lightweight Directory Access Protocol (LDAP), Central Authentication Service (CAS) and Security Assertion Markup Language (SAML) lack comprehensive analysis from conception to physical implementation to incorporate these solutions thereby resulting in impractical and fractured solutions. In this paper, we have implemented Identity and Access Management System (IAMSys) using the Lightweight Directory Access Protocol (LDAP) which focuses on authentication, authorization, administration of identities and audit reporting. Its primary concern is verification of the identity of the entity and granting correct level of access for resources which are protected in either the cloud environment or on-premise systems. A phased approach methodology was used in the research where it requires any enterprise or organization willing to adopt this must carry out a careful planning and demonstrated a good understanding of the technologies involved. The results of the experimental evaluation indicated that the average rating score is 72.0 % for the participants involved in this study. This implies that the idea of IAMSys is a way to mitigating security challenges associated with authentication, authorization, data protection and accountability if properly deployed.

Integrasi Sistem Single Sign On Pada Sistem Informasi Akademik, Web Information System Dan Learning Management System Berbasis Central Authentication Service

Elearning and web based information systems is a means to communicate and exchange information for academic purposes. Nowadays lightweight directory access protocol (LDAP) is a state of the art method of choice. With LDAP technologies user only need one username and password to access to multiple web based application, The problem is if the user wanted to do autentification said user had to input their credentials over and over again for each application. To solve that problem single sign on mechanism (SSO) is invented. With SSO user only need login once and they got all the same credentials with them to all intergrated application wthin the campus. To implement the SSO we use Central authentication service (CAS) as a authentifiation central within LDAP structure as a user management. In this reseach we see that single sign on (SSO) system that intergrated into student management system, E-Learning system and Internal blog system both use of database based system or even LDAP based system.

Persistent data backend for OPC UA namespaces in IT infrastructures

This paper presents an approach for persistent data backends for OPC UA namespaces. OPC UA as M2M protocol is used in various manufacturing machines and provides data access to e.g. sensors and setpoints. The central and persistent data storage for e.g. data-mining and condition-monitoring services in information technology infrastructures is challenging. Therefore, a holistic approach for storing OPC UA information in lightweight directory access protocol server is presented including a model for storing namespaces, information models and values in LDAP trees of scalable enterprise infrastructures to fulfil manufacturing and IT requirements in the context of Industry 4.0.

LDAP Vulnerability Detection in Web Applications

Lightweight Directory Access Protocol (LDAP) is commonly used in web applications to provide lookup information and enforcing authentication. Web applications may suffer from LDAP injection vulnerabilities that can lead to security breaches such as login bypass and privilege escalation. This paper1 proposes OCL fault injection-based detection of LDAP injection attacks. The authors extract design-level information and constraints expressed in OCL and then randomly alter them to generate test cases that have the capability to uncover LDAP injection vulnerabilities. The authors proposed approaches to implement test case generation, and they used one open source PHP application and one custom application to evaluate the proposed approach. The analysis shows that this approach can detect LDAP injection vulnerabilities.

INTEGRATION OF INFORMATION AND EDUCATIONAL SYSTEMS IN THE UNIVERSAL EDUCATION UNIVERSITY ELECTRONIC ENVIRONMENT

The article is devoted to the integration of educational resources and educational and informational systems in a single information and educational environment of the university. Access to the university's information and educational environment is carried out through the additional web-site of the official portal “Information and educational environment” for authorization, which uses technology of the single sign-on point, the main element of which is the creation of a user database. Taking into account the features of the analyzed directory services and the use of the domain structure of the network organization, we have selected to create the Lightweight Directory Access Protocol (LDAP) database using the OpenLDAP open protocol. Were described the implementation of the settings for a single sign-on page using the protocol for the web CAS (Central Authentication Service). To synchronize the University's corporate email and available Google services with the LDAP database, Google Apps developed a Google Apps Directory Sync application that synchronizes the structure and all users in Google Apps. In order to synchronize the e-learning system based on the LMS Moodle, an existing appropriate module was used to authenticate users through the LDAP database. Configuring the module, synchronizing users and groups is presented in the article. Also are listed the settings specified in the LocalSettings.php file that are related to LDAP authentication with the university's wiki portal via the installed and connected LDAP authentication module. Also we described an approach to synchronizing users with the systems of scientific conferences and seminars based on the open conference system engine, which includes a module for LDAP authentication. DOI: https://doi.org/10.28925/2414-0325.2017.3.6ez16

Cloud Computing Environment and Security Challenges: A Review

Cloud computing exhibits a remarkable potential to offer cost-effective and more flexible services on-demand to the customers over the network. It dynamically increases the capabilities of the organization without training new people, investment in new infrastructure or licensing new software. Cloud computing has grown dramatically in the last few years due to the scalability of resources and appear as a fast-growing segment of the IT industry. The dynamic and scalable nature of cloud computing creates security challenges in their management by examining policy failure or malicious activity. In this paper, we examine the detailed design of cloud computing architecture in which deployment models, service models, cloud components, and cloud security are explored. Furthermore, this study identifies the security challenges in cloud computing during the transfer of data into the cloud and provides a viable solution to address the potential threats. The task of Trusted Third Party (TTP) is introducing that ensure the sufficient security characteristics in the cloud computing. The security solution using the cryptography is specifically as the Public Key Infrastructure (PKI) that operates with Single-Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP) which ensure the integrity, confidentiality, availability, and authenticity involved in communications and data.

Inhibiting and Detecting Offline Password Cracking Using ErsatzPasswords

In this work, we present a simple, yet effective and practical scheme to improve the security of stored password hashes, increasing the difficulty to crack passwords and exposing cracking attempts. We utilize a hardware-dependent function (HDF), such as a physically unclonable function (PUF) or a hardware security module (HSM), at the authentication server to inhibit offline password discovery. Additionally, a deception mechanism is incorporated to alert administrators of cracking attempts. Using an HDF to generate password hashes hinders attackers from recovering the true passwords without constant access to the HDF. Our scheme can integrate with legacy systems without needing additional servers, changing the structure of the hashed password file, nor modifying client machines. When using our scheme, the structure of the hashed passwords file, e.g., etc/shadow or etc/master.passwd , will appear no different than traditional hashed password files. 1 However, when attackers exfiltrate the hashed password file and attempt to crack it, the passwords they will receive are ErsatzPasswords—“fake passwords.” The ErsatzPasswords scheme is flexible by design, enabling it to be integrated into existing authentication systems without changes to user experience. The proposed scheme is integrated into the pam_unix module as well as two client/server authentication schemes: Lightweight Directory Access Protocol (LDAP) authentication and the Pythia pseudorandom function (PRF) Service [Everspaugh et al. 2015]. The core library to support ErsatzPasswords written in C and Python consists of 255 and 103 lines of code, respectively. The integration of ErsatzPasswords into each explored authentication system required less than 100 lines of additional code. Experimental evaluation of ErsatzPasswords shows an increase in authentication latency on the order of 100ms, which maybe acceptable for real world systems. We also describe a framework for implementing ErsatzPasswords using a Trusted Platform Module (TPM).

A Petri-Net-Based Virtual Deployment Testing Environment for Enterprise Software Systems

The landscape of modern enterprise IT environments is that a large number of distributed software systems interact and cooperate with each other to support daily business operations. With the prevalence of cloud computing, the level of system connectivity increases further. The large scale of such an environment makes it difficult to test a system's quality attributes such as performance and scalability before it is actually deployed in the production environment. Under the currently dominant iterative and incremental software development paradigm, this difficulty is even more pronounced when the quality attributes of an enterprise system need to be examined and evaluated at early stages but a large part of its operating environment is not available or accessible. In this paper, we present a Coloured Petri nets (CPN) based system behaviour emulation approach and a lightweight emulated testing framework for provisioning a virtual deployment testing environment for an enterprise software system, so that its quality attributes, especially scalability, can be evaluated without physically connecting to the real production environment. It is worth noting that the focus of this work is on the testing environment which enables virtual system deployment and testing, instead of being on the research topic of deployment test. CPN and its associated design and simulation tools have been used and integrated to model and execute the behaviour of those cooperating endpoint systems that an enterprise software system interacts with. We have successfully implemented an industry standard protocol Lightweight Directory Access Protocol in our approach and applied it in testing the scalability of a real-world enterprise application, CA Technologies' IdentityManager. A thorough in-lab performance study has also been conducted to examine the capacity and scalability of this approach.

Sistem Autentikasi Hotspot Menggunakan LDAP dan Radius pada Jaringan Internet Wireless Prodi Teknik Sistem Komputer

Wireless network is a network utilizing radio waves that propagate openly. This network requires security to simplify the process by using user Authentication. One of technology that could be used in order to make it safer is a Lightweight Directory Access Protocol (LDAP) and Remote Authentication Dila In User Service (RADIUS). Computer Systems Engineering Department is one of the study program in the Faculty of Engineering, University of Diponegoro that reserve the internet service everyday for students need. However, internet wireless network in this department is not yet safe enough,for the necessary to secure it’s need creating a security system with LDAP and RADIUS.The results of this study is a network authentication server using OpenLDAP and FreeRadius Hotspot that will be integrated with an account of Academic Information System, which is implemented on Prodi Computer Systems Engineering Department of the University of Diponegoro.

Perancangan Sistem Filtering Akses Website Dengan Menerapkan Otorisasi LDAP Grup Pada Proxy Server

Improper use of the internet could negatively impact on users, especially students. This is because a lot of their time is spent just to access websites and online game services providers or friendship website known as social media, even used to access and download images or videos that fall into the category of pornography. Therefore, it needs a system that can be used to restrict access to the internet usage in the campus area, with the aim to overcome the problems that occur with the better. This study was undertaken to design a system that can be used to restrict user access to the website address which is intended to implement the system of filtering access to websites on the Proxy Server, as well as a way to authorize users based on the type of account that is used to access the Internet using a mechanism classification account based group on Lightweight Directory Access Protocol. If his account common types, then the user will not be able to access the game's website, social media, and even pornography. However, if his account special types, such as its example is a lecturer, then the user can access all websites except websites that contain pornography. So that the system is built is expected to reduce the use of the Internet that is not useful, especially campus environment, and the use of internet facilities can be beneficial to both for teaching and learning environment of the campus.

Hierarchical Role-Based Access Control for Multi-User Collaborative CAD Environment

ABSTRACTCommercial computer aided design (CAD) applications have traditionally been based on a single user architecture. Recent research on multi-user collaborative CAD and other computer aided applications (CAx) have shown promising and highly functional prototypes of multi-user concurrent designing tools based on popular and market leading commercial software systems such as Siemens NX. However, for these prototypes to be deployed to the real-world corporate environment for commercial projects, security features such as access control and encrypted transport must be implemented as integral part of the enterprise network infrastructure.Directory services (DS) such as Microsoft Active Directory and Lightweight Directory Access Protocol (LDAP) has become the standard software and protocol for managing resources in the complex modern enterprise network. DS controller authenticates and authorizes user's access to resources and enforces security policies. This research presents a method to integrate existing ...

Inventions on LDAP - A Study Based on US Patents

Lightweight Directory Access Protocol (LDAP) is an IETF open standard to provide directory services in the network. LDAP is based on X.500 directory architecture, intended to provide directory services in Internet compatible environments. LDAP is used to provide directory services to applications ranging from e-mail systems to distributed system management tools. LDAP is becoming more and more popular with its wider usage in the Internet.This report on LDAP is based on a study of 60 selected patents on LDAP from US patent database. The objective of this article is to present the distribution of patents according to different features and functions of LDAP and to present the hot issues on LDAP for current and future inventions.

Beyond the Boundaries: Remote Access to Online Resources at the University of Moratuwa Library

Though libraries have invested very high percentage of its annual budget to subscribe e-resources, limited attention was paid to ensure consistent and reliable access of those resources. Many library users access e-resources from outside of the University. Therefore many requests have been made to implement a remote access mechanism for e-resources. The objective of the study was to design a proper remote access mechanism to the users for accessing the e-resources provided by University of Moratuwa library. Publishers have provided access to eresources through Internet Protocol (IP) authentication and not by user identity (user ID) and password. This kind of access created many problems to the users specially for the postgraduate students who do not visit the University regularly as many users need to access e-resources from anywhere, anytime. Using the concept of proxy server, a joint project was conducted between the Center for Information Technology Services (CITeS), University of Moratuwa and the library to provide remote access. Existing Lightweight Directory Access Protocol (LDAP) was used to authenticate the user access. This allowed remote user to obtain regular, secure access to library e-resources. Journal of the University Librarians Association, Sri Lanka, Vol. 17, Issue 2, January 2013, Page 76-87 DOI: http://dx.doi.org/10.4038/jula.v17i2.6646

Key Technology on Uniform Identity Authentication for Digital Campus

Digital campus is an important part of university construction, original campus network teaching, research, management, service and other application system, use a separate identity authentication, neither convenient memory, but also manage and maintain trouble. Contrary to identity authentication problem, this paper research uniform identity authentication key technology, include uniform identity authentication system model, remote authentication dial in user service, lightweight directory access protocol and so on. Uniform identity authentication is the foundation work of digital campus, the disperse user centralized management and permissions resources, help achieve the intranet information portal user uniform authentication, simplify user accessing to the internal process of the application system, so users only need to pass uniform identity authentication once have permission to access all resources.