Systems and methods for second protocol communication over LDAP

1. A monitoring device, comprising:

a processor;

a memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable to:

intercept a lightweight directory access protocol (LDAP) search request sent to an LDAP search handler of a security subsystem from a calling device, the LDAP search request comprising a query string containing data for a second protocol, wherein the LDAP search handler performs LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to the LDAP search handler;

generate response data for the second protocol to substitute for a response by the LDAP search handler; and

send an LDAP search result to the calling device, the LDAP search result comprising the response data for the second protocol.

2. The monitoring device of claim 1 , wherein the query string causes the LDAP search handler to generate an empty dataset or error response.

3. The monitoring device of claim 1 , wherein the query string is formatted with a valid LDAP search request format.

4. The monitoring device of claim 1 , wherein the query string comprises a command for the monitoring device to perform an operation and a number of key value pairs to be used in the operation.

5. The monitoring device of claim 1 , wherein the query string comprises a filter to indicate that the LDAP search request is a modified LDAP search request.

6. The monitoring device of claim 1 , wherein the LDAP search result comprises a number of attributes that include the response data.

7. The monitoring device of claim 1 , the instructions being further executable to:

send the LDAP search request to the LDAP search handler to generate a first LDAP search result with an empty dataset or error response; and

substitute the empty dataset or error response of the first LDAP search result with the response data for the second protocol.

8. The monitoring device of claim 1 , wherein the monitoring device comprises a domain controller configured with the LDAP search handler, a search interceptor to intercept the LDAP search request, and second protocol response generator to generate the response data.

9. The monitoring device of claim 1 , wherein the LDAP search request is sent for password validation.

10. The monitoring device of claim 1 , wherein the LDAP search request is sent for reporting workstation logins.

11. A method by a monitoring device, comprising:

intercepting a lightweight directory access protocol (LDAP) search request sent to LDAP search handler of a security subsystem, the LDAP search request comprising a query string containing data for a second protocol, wherein the LDAP search handler performs LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to the LDAP search handler;

generating response data for the second protocol to substitute for a response by the LDAP search handler; and

sending an LDAP search result to the calling device, the LDAP search result comprising the response data for the second protocol.

12. The method of claim 11 , further comprising:

sending the LDAP search request to the LDAP search handler to generate a first LDAP search result with an empty dataset or error response; and

substituting the empty dataset or error response of the first LDAP search result with the response data for the second protocol.

13. A calling device, comprising:

a processor;

a memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable to:

detect an event;

generate a lightweight directory access protocol (LDAP) search request with a query string containing data for a second protocol, wherein the LDAP search request is for LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to an LDAP search handler;

send the LDAP search request to a monitoring device; and

receive an LDAP search result containing response data for the second protocol that substitutes for a response by the LDAP search handler.

14. The calling device of claim 13 , wherein the query string is formatted with a valid LDAP search request format but causes the LDAP search handler to generate an empty dataset or error response.

15. The calling device of claim 13 , wherein the query string comprises a command for the monitoring device to perform an operation and a number of key value pairs to be used in the operation.

16. The calling device of claim 13 , wherein the query string comprises a filter to indicate that the LDAP search request is a modified LDAP search request.

17. The calling device of claim 13 , wherein the LDAP search result comprises a number of attributes that include the response data.

18. The calling device of claim 13 , the instructions being further executable to perform an operation in response to the response data.

19. A method by a calling device, comprising:

detecting an event;

generating a lightweight directory access protocol (LDAP) search request with a query string containing data for a second protocol, wherein the LDAP search request is for LDAP operations, wherein the query string is for a second protocol operation that is separate from the LDAP operations, and wherein the query string is meaningless to an LDAP search handler;

sending the LDAP search request to a monitoring device; and

receiving an LDAP search result containing response data for the second protocol that substitutes for a response by the LDAP search handler.

20. The method of claim 19 , further comprising performing an operation in response to the response data.