Re: AD and SSL
From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 07/28/04
- Next message: FurBot: "Re: Enterprise admin cannot log into child domain"
- Previous message: Eric Fehlhaber: "Active Directory Conversion"
- In reply to: ADified: "AD and SSL"
- Messages sorted by: [ date ] [ thread ]
Date: Wed, 28 Jul 2004 09:15:06 -0500
You can use AD over an SSL connection without using SSL client certificates
for authentication. Depending on the API you are using, you'll usually just
do an ldap_sslinit or with ADSI get your binding options to
SecureSocketsLayer. After that, the channel will be encrypted. You can
also encrypt the channel using Kerberos if your client supports it.
Regarding the CA, it is necessary that the client trusts the root that
signed your server's certificate. You can do this by either purchasing a
cert from a CA that is already trusted or ensuring that the root cert is
trusted by the client.
HTH,
Joe K.
"ADified" <ADified@discussions.microsoft.com> wrote in message
news:FD82CE03-4359-41C9-A9AF-FD0037217014@microsoft.com...
> I have been experimenting with AD2000 as well as AD2003. I have written a
client app in language X and it creates and removes user entries in AD fine.
However, I 'd like to set the password attribute and that seems to imply
SSL. Supported authentication mechanisms as reported by my LDAP interface
to AD2003 are the following:
> GSSAPI
> GSS-SPNEGO
> EXTERNAL
> DIGEST-MD5
> The reported authentication mechanisms for AD2000 are only the first 2 in
the list above.
> Is there some particular reason for this?
>
> Having RTFMed a bit on how to make AD talk SSL I have come to the
conclusion that I need to set up AD and its client (my application) with
the same Certification Authority. So I have set up the CA server
(enterprise) and although it accepts requests from my client I cannot get it
to cooperate with AD. I have looked around in the documentation and have
read tons of irrelevant pages.
>
> Can anyone offer some pointers on how to set up AD2000 or AD2003 ready to
communicate in SSL (in particular DIGEST-MD5 is the authentication mechanism
I'd like to use)?
>
> thanx in advance,
>
> b
- Next message: FurBot: "Re: Enterprise admin cannot log into child domain"
- Previous message: Eric Fehlhaber: "Active Directory Conversion"
- In reply to: ADified: "AD and SSL"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
