Just converting this to a feature request to better represent it's type.
This is is as a result of a conversion along the lines of "Wouldn't it be nice if we could do X" where X is to relay Digest challenges from the LDAP server to the client in place of our own challenges and then we send the resulting response back to the LDAP server.
In addition to integration issues within WildFly this would also require substantial changes to the SASL libraries, the Digest server would of course need to be able to send proxied challenges to the client instead of handling them itself and also it would need to forward responses it receives - there would most likely need to be a new SASL Client that communicates with the LDAP Server and also handles a lot of the proxying.
Libraries used for the communication would most likely also need modification as it is not easy within the SASL mechs here to detect a successful completed exchange.
But the most important factor is that we have not proven proxying in this way is even possible, there are certain man in the middle protections within the mechanisms that may actually prevent this from happening. The first step really is to verify if this is even possible.
Feature Request
Major
Just converting this to a feature request to better represent it's type.
This is is as a result of a conversion along the lines of "Wouldn't it be nice if we could do X" where X is to relay Digest challenges from the LDAP server to the client in place of our own challenges and then we send the resulting response back to the LDAP server.
In addition to integration issues within WildFly this would also require substantial changes to the SASL libraries, the Digest server would of course need to be able to send proxied challenges to the client instead of handling them itself and also it would need to forward responses it receives - there would most likely need to be a new SASL Client that communicates with the LDAP Server and also handles a lot of the proxying.
Libraries used for the communication would most likely also need modification as it is not easy within the SASL mechs here to detect a successful completed exchange.
But the most important factor is that we have not proven proxying in this way is even possible, there are certain man in the middle protections within the mechanisms that may actually prevent this from happening. The first step really is to verify if this is even possible.