The biggest weakness when using native Lightweight Directory Access Protocol (LDAP) for authentication is that passwords are passed in clear text over the network, exposing them to eavesdropping and interception attacks. To mitigate this risk, LDAP should be used with encryption protocols, such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS), or with authentication protocols, such as Kerberos or Simple Authentication and Security Layer (SASL).
* A. Authorizations are not included in the server response is not the biggest weakness when using native LDAP for authentication, but rather a limitation of the protocol that requires additional mechanisms to implement access control policies.
* B. Unsalted hashes are passed over the network is not the biggest weakness when using native LDAP for authentication, but rather a potential vulnerability of the password storage scheme that could expose passwords to brute-force or dictionary attacks.
* C. The authentication session can be replayed is not the biggest weakness when using native LDAP for authentication, but rather a possible threat that could compromise the confidentiality and integrity of the session data.
References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5, page 281; Official (ISC)2 CISSP CBK Reference, Fifth Edition, Chapter 5, page 230