Using Kerberos, RADIUS, and LDAP for WLAN Authentication

Using Kerberos, RADIUS, and LDAP for WLAN Authentication

While wireless networking applications benefit from location independence and freedom of mobility, they all have the same security challenge— authentication. When considering a security implementation, authentication is a key component of any security solution. Mutual authentication, where both the client and the server must authenticate with each other, is used to ensure that only authorized users are allowed on the network. Kerberos, Remote Authentication Dial-In User Service (RADIUS), and LDAP are popular and useful authentication solutions that meet this security challenge in WLANs.

Kerberos is designed to enable two parties to exchange private information across an otherwise insecure network. Kerberos provides mutual authentication between a client and a server, as well as between servers, before a network connection can be opened. It uses a technique that involves a shared secret, which works much like a password. This happens by assigning a unique key, called a ticket, to each user who logs on to the network. The ticket is then embedded in messages to identify the sender of the message.

RADIUS servers are robust, scalable servers that provide authentication, authorization, and accounting (AAA) functions and advanced policy and custom configuration management to control user access to wired and wireless networks. Radius and LDAP are often used together in WLAN applications.