Directory & AAA

The LDAP Bind operation sets the authentication state of an LDAP session. Before any Bind, and after any Bind that fails, the session is anonymous: it can already send searches, but every request is evaluated as an unauthenticated caller.

An LDAP Control rides along on a request the protocol already defines and changes how the server carries it out. An extended operation is a whole new request, named by its own OID, that the base operation set never had.

A Distinguished Name chains the entry's own Relative Distinguished Name onto every ancestor's, up to the naming context the server holds. In the RFC 4514 string form the leftmost component is the entry itself and the rightmost sits nearest the root.

LDAPResult is the shared reply body for Add, Modify, ModifyDN, Delete and Compare. It carries a numeric resultCode such as success(0), a matchedDN showing how far the server resolved the name, and a human-readable diagnosticMessage.

A directory entry's objectClass attribute names the classes the entry belongs to, and those classes' MUST and MAY lists decide which attributes it may hold. The abstract class top requires the attribute, so every entry carries it.

One sign-in returns a ticket-granting ticket plus a session key. The user spends that ticket at the ticket-granting service for a short-lived service ticket, and the archive server validates that ticket with its own long-term key — the password itself never reaches it.

A GSS-API context-establishment token, normally a SPNEGO NegTokenInit wrapping a Kerberos AP-REQ built from a service ticket. It is one leg of a handshake for one service, not the user's password.

The ticket-granting ticket is sealed under the krbtgt principal's long-term key, so the requesting client cannot open it. The AS-REP's enc-part beside it is sealed under the client's own long-term key and carries the session key, the ticket flags and the expiry times.

KDC_ERR_PREAUTH_REQUIRED (25) means the KDC will not issue a ticket until the client proves it holds its long-term key. The error's e-data carries METHOD-DATA listing the pre-authentication types accepted, and the client resends the AS-REQ with PA-ENC-TIMESTAMP.

Pass-the-Ticket runs the AP exchange only: an AP-REQ carrying the stolen service ticket plus a fresh Authenticator sealed under that ticket's session key. The service checks decryption, names and timestamp, never who copied the ticket.

The network access server - the switch, wireless access point or remote-access concentrator the user connects through - is the RADIUS client and sends the Access-Request. The user's laptop sends no RADIUS packet at all; it is the subject of the exchange.

Acct-Status-Type (40) marks each RADIUS accounting record: Start (1) when the session begins, Interim-Update (3) on a timer while it runs, and Stop (2) when it ends. Each record goes to UDP port 1813 as an Accounting-Request (Code 4).

A pass-through authenticator copies every EAP packet between the peer and the RADIUS server inside EAP-Message (79) attributes without parsing the method, so the server terminates EAP-TLS or a tunnelled method and the access device only applies the verdict it gets back.

A RADIUS server answers an Access-Request with Access-Accept (Code 2), Access-Reject (Code 3) or Access-Challenge (Code 11). Accept and reject end the exchange; a challenge asks for more input and expects a further Access-Request.

RADIUS answers authentication and authorization in one round trip: the attributes inside an Access-Accept are the grant, so there is no second request. Accounting is a different exchange, with its own packet codes and normally its own port, and it can fail on its own.

The network device sends it — in TACACS+ the client is the device, not the human at the keyboard. The accounting exchange is a REQUEST/REPLY pair asking the device-administration server to record what happened, after the fact.

A TACACS+ session is one authentication sequence, one authorization exchange or one accounting exchange, named by session_id in the header. It travels over a TCP connection to port 49 that the network device opens to the device-administration server.

TACACS+ over TCP port 49 gets ordered, acknowledged delivery and an explicit connection whose loss is visible, so it can hold a multi-exchange conversation open. RADIUS over UDP makes the network access server own retransmission and server-liveness guessing itself.

START opens a task, STOP closes it, WATCHDOG says a long-running task is still alive. START and STOP are mutually exclusive, STOP must not be combined with WATCHDOG, and WATCHDOG with START means the update carries new or changed arguments.

The device-administration server decides. Its REPLY carries a status — GETUSER, GETPASS or GETDATA — and a server_msg the network device displays as the prompt; the device answers with one CONTINUE and waits for the next REPLY.