Using Javascript to generate SASL MD5 digest to authenticate with Active Directory?

Question

I have a web application that requires users to login. I want to authenticate them on the company's Active Directory domain.

I have a working mechanism working where I can require credentials using HTTP Basic authentication, and then use python's ldap.sasl package to create an MD5 digest and pass that to the AD server for authentication.

The problem with HTTP Basic is that for a time, my application code will possess a cleartext password - I'm a trustworthy guy, of course, but this won't fly with the security team.

I could require a HTTPS Digest Authentication from the browser, but I can't re-use that MD5 digest for authenticating with Active Directory (or can I?).

Does some client-side (javascript) logic exist out there that lets me generate a MD5 digest that I can pass directly to Active Directory ?

Answer 1

Here's a JavaScript library that can do MD5 hashes: https://code.google.com/p/crypto-js/.

Not sure how this will alleviate the concerns of your security team as you still need the clear text password in your JavaScript app.

Also, be aware that doing crypto in the browser comes with a bunch of risks.