I have NAS drive which is bound to an Open Directory LDAP server for authentication with SSL enabled. The NAS allows for CIFS shares to be accessed via LDAP authentication. (in this case the NAS is a Synology but I think the question is generally independent of the Manufacture) http://www.synology.com/support/tutorials_show.php?q_id=465
Synology mentions that authenticating CIFS access to an LDAP server rather than Active Directory will enforce PAM authentication requiring the Windows Client to transmit the passwords in PlainText. The windows client has to enable this with a change in the registry setting.
My question pertains to how does enabling the LDAP/SSL fit in to this and how does the handshaking between -the Windows Client -the NAS Cifs Share -the LDAP server all play out
I don't really need to be concerned about passwords in plain text if they are encapsulated over SSL. Does the SSL only exist between the NAS and the LDAP server or does it also exist between the Windows client and the NAS? My current thinking is the Windows client sends the NAS credentials in plain text for access to a CIFS share then the NAS relays these credential over SSL to the LDAP to get a yes or no.
Or do I have the authentication process all wrong?
Synology is adamant there is nothing they can do about it, and from what I can tell its not just Synology but anyone with this configuration. But I'm wondering why the Windows client can't connect authenticate to the NAS via MSCHAP and have the NAS turn around and relay the user/pass to the LDAP via PAM/SSL? It seems like I'm missing something?