LDAP vs Kerberos - Which is better?
Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment?
AndCan we switch between them transparently?
LDAP vs Kerberos
Where possible use Kerberos authentication above all else. It was built for providing authentication/authorization and is the most secure option. The whole premise is to exchange credentials in an environment that isn't trusted. LDAP can be easily misconfigured to send credentials in clear text over the network. An easy way to prevent this is to always use LDAPS (TCP636) as it encapsulates all traffic in SSL. LDAP is often used for adhoc authentication/authorization, especially web applications using forms authentication.