Pass-Through Authentication

[Tim Gustafson <tjg@soe.ucsc.edu>]

How hard would it be to create a new pass-through authentication mechanism (something other than SASL) for OpenLDAP?  Can this be done in an overlay?

The reason I ask is that I'm investigating using two-factor authentication.  If I understand the marketing materials correctly, both the RSA SecureID system and the WiKID system expose a RADIUS server that clients can authenticate with.  The suggested set-up seems to be:

OpenLDAP -> SASL -> pam -> RADIUS (on 3rd party token server)

This seems like a lot of intermediaries, and a lot of potential "breaking" points.  I wonder if there isn't any way to just cut the middle man out, so to speak, and have OpenLDAP talk directly to a RADIUS server, eliminating the other layers inbetween:

OpenLDAP -> RADIUS (on 3rd party token server)

Perhaps a password scheme like:

{RADIUS}user@radius-server

I've worked with RADIUS before, and it's not all that bad from a client implementation perspective, especially if you ignore the challenge/response part of the protocol (which most simple authentication services seem to do).

Or should I just shut up and use the first method?  :)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Tim Gustafson                                                tjg@soe.ucsc.edu
Baskin School of Engineering                                     831-459-5354
UC Santa Cruz                                         Baskin Engineering 317B
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-