In an LDAP authentication flow, who requests the user credentials?

In an authentication flow where Zscaler is integrated with a customer's LDAP or Active Directory, the Zscaler service (specifically, the Zscaler Enforcement Node or ZEN) intercepts the user's web request. Because the user is unauthenticated, the Zscaler service redirects the user's browser to a Zscaler-hosted authentication portal. This portal is what presents the login form and directly requests the user to enter their credentials. Zscaler then uses these credentials to query the backend LDAP/AD server for validation.

A. An NSS (Name Service Switch) server is used for resolving names from various sources in Unix-like systems, not for requesting user credentials in this context.

B. A SAML Identity Provider is part of a different authentication framework (SAML), which typically involves redirection to the IdP's own login page, not an LDAP flow.

C. Active Directory (or any LDAP server) is the backend directory service that validates the credentials provided by Zscaler; it does not directly request them from the user.

1. Zscaler. (2024). About User Authentication. Zscaler Help Portal. "When a user opens a browser and tries to go to a location... the ZIA Public Service Edge redirects the user to the Zscaler service for authentication."

2. Zscaler. (2024). Configuring LDAP Integration. Zscaler Help Portal. This document details the process where Zscaler collects credentials and then uses an LDAP Admin account to bind to and search the directory, confirming Zscaler's role as the intermediary.