I am creating a Haskell web application for which I need authentication. My organization starts the LDAP server, and I would prefer not to reinvent the wheel. However, when I check the source code for LDAP.Init.ldapSimpleBindfrom within the package ldap-haskell, I find that it invokes the C procedure ldap_simple_bind_s. As far as I can tell, this API call is about to send my user passwords in clarity to the LDAP server. Unacceptably.
I correctly understood what is doing ldap-haskell?
If so, is there a safe way to authenticate my users to an LDAP server from an application written in Haskell?
source
share