LDAP Authentication and Authorization over TLS

LDAP Authentication over TLS

• Junos OS User Authentication Overview

• Benefits of LDAP Authentication over TLS

• Supported and Unsupported Features

• LDAP Overview

• Transport Layer Security (TLS) Overview

• How LDAPS Authentication Works

Junos OS User Authentication Overview

Junos OS authenticates users trying to log in either locally or by using a centralized database. Local authentication or authorization is possible for users whose username and password are configured using the Junos OS CLI or RPCs. In Junos OS Release 20.2R1, Junos OS supports LDAP with TLS security (LDAPS) support for user login and ensures secure transmission of data between the LDAPS client and the LDAPS server.

In releases before Junos OS Release 20.2R1, Junos OS supports centralized user authentication and authorization through standard RADIUS and TACACS protocols.

Figure 1: Centralized Authentication, Authorization, and Accounting (AAA) Setup

Junos OS supports these methods of user authentication:

• Local password authentication

• LDAP over TLS (LDAPS)

• RADIUS

• TACACS+

Benefits of LDAP Authentication over TLS

• Encryption and data integrity—LDAPS ensures that user credentials are encrypted, thereby maintaining privacy of communications. The user encrypts the data using the private key and only the intended recipient that possesses the private key can decrypt the signed data using the signer's public key. This ensures data integrity.

• Enhanced security—The TLS protocol ensures the data is securely sent and received over the network. TLS uses certificates to authenticate and encrypt the communication that provides advanced security.

• Scalability—LDAPS provides greater performance and scalability without loss of reliability. There is no limit to the number of users who can be supported using this feature as users maintain their own certificates, and certificate authentication involves exchange of data between client and server only.

Supported and Unsupported Features

• Junos OS supports LDAPS for user authentication and authorization only. Junos OS does not support accounting. over LDAPS.

• The LDAPS client is implemented and integrated as part of Junos OS. However, implementation of the LDAPS server on Junos OS is not supported. Instead, this feature is implemented using the OpenLdap 2.4.46 server.

LDAP Overview

Lightweight Directory Access Protocol (LDAP) is a standard application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. You can accomplish authentication and authorization using the following rich set of LDAP security functions such as:

• Search

• Retrieve

• Directory content manipulation

Transport Layer Security (TLS) Overview

TLS is an application-level protocol that provides encryption technology for the Internet. It is the most widely used security protocol for applications that require data to be securely exchanged over a network, such as file transfers, VPN connections, instant messaging, and voice over IP (VoIP). TLS relies on certificates and private-public key exchange pairs to secure the transmission of data between the LDAPS client and the LDAPS server. LDAPS uses local certificates that are dynamically acquired from the Junos public key infrastructure (PKI) .

TLS ensures secure transmission of data between a client and a server effectively and ensures privacy of communications, authentication, confidentiality, and data integrity. You can use the TLS protocol for certificate exchange, mutual authentication, and cipher negotiation to secure the stream from potential tampering and ethical hacking.

How LDAPS Authentication Works

To provide secure LDAPS support for Junos OS operator login, user credentials and configurations are stored in either the LDAPS server or the LDAP-supported databases. An LDAPS client on the device running Junos OS communicates with a configured LDAPS server. To achieve this, the LDAPS client is implemented and integrated as part of the device running Junos OS.

Figure 2 shows the LDAPS authentication process.

Figure 2: LDAPS Authentication Process

1. A remote user logs in to a device running Junos OS through SSH, TELNET or any other login utility.
2. The LDAPS client (which is the device running Junos OS) establishes a TCP connection with the LDAPS authorization server using a TLS protocol request.
3. After the client receives the TLS response, the client and server authenticate their identities.
4. The LDAPS client authenticates itself using the proxy account that is preconfigured on the LDAPS server using the bind request (binddn and bindpw).
5. If the bind operation is successful, the LDAPS server sends an acknowledgment to the LDAPS client.
6. The LDAPS client then sends an authentication request to the LDAPS server with the login credentials of the user trying to log in.
7. After successful authorization, the LDAPS client notifies the user of the successful login. The authorization data of the user is saved into a file that is used later to enforce authorization.
8. The client closes the connection with the LDAPS server.