Re: LDAPS connnectivity

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

It depends on what APIs are in use, but with Windows-based LDAP APIs, you
can still get an LDAPS connection by specifying just the domain. If the
current security context is an account in the domain you want to access, you
can do a serverless bind. Either will work.

I'm not sure if you'll have the same results with other API stacks. Since
you have specified anything about what the client code is here, it is hard
to say for sure.

It is also possible to call DsGetDCName explicitly instead of allowing the
LDAP API to do this work implicitly. This is all in all a much better
approach than to try to impose another load balancing technique on top of
AD.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Oscar P." <OscarP@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F9D4F5F1-9267-491E-9B2A-8953CF53ED7C@xxxxxxxxxxxxxxxx
I'm not sure what you mean by having the applications use the DC locator
service. The connection provider requires a target for ldap or ldaps
connection. Are you suggesting we use "domain.com" instead of
"DCname.domain.dom" and have the locator service select a DC? If that is
the
case, will that work with SSL because "domain.com" doesn't match the
subject
name of "DCname.domain.com" in the certificate on the DC.

Thanks
Oscar

"Joe Kaplan" wrote:

You might be able to get this to work with a wildcard certificate
(*.domain.com) as that is the way this works with ADAM, but you really
shouldn't be load balancing LDAP access to your DCs this way. AD already
has a built-in load balancing mechanism via the DC locator service and
you
should be using that in your applications instead. It avoids this whole
problem. The reason that mechanism exists for ADAM is that ADAM does not
have a similar locator facility like AD does.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Oscar P." <OscarP@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2CFA3B3F-92ED-44E7-9957-63B9C36F134D@xxxxxxxxxxxxxxxx
Is there ANY way to configure SSL certificates on domain controllers to
allow
for ldaps connections to more than one host name?

We can initiate an SSL connection to the FQDN hostname of the DC no
problem, but also want to connect using a load-balanced Virtual host
name
to
allow for application failover. This appears to be impossible unless
maybe I
try using a wildcard certificate but have heard that not all
applications
will support wildcard certs.

Would any other method, like maybe using Subject Alternate Name in the
cert,
or binding a second IP to the DC, work?

Thanks
Oscar







.

Relevant Pages

  • Re: SSL bind to LDAP for password change
    ... Do you have any idea if the SSL handshake, the LDAP connection or the bind operation is at issue? ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.platformsdk.security)
  • Re: How do I convert sid retrieved from the AD to SDDL string form
    ... LDAP doesn't support joins. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... objectSid property to a SecurityIdentifier class. ...
    (microsoft.public.dotnet.security)
  • Re: Urgent: Restrict LDAP Queries of a domain user
    ... The way I read your question was from a strictly LDAP sense. ... query, they can do a one-level or base level query as well. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: Tuning LDAP
    ... changing the maxPageSize from the default of 1000. ... single LDAP query and forcing the LDAP client to use paged queries to ... As such, any app, including an innocuous looking script, could begin causing ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: LDAP authentication security ?
    ... Using an internally rooted CA can be less expensive, but it is less easy to get all of the clients to trust your certs issued by this CA, especially in an environment that includes non-Windows machines that can't take advantage of auto enrollment or GPO for distributing trusted roots. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... If the application supports SASL bind with either GSS-SPNEGO or DIGEST authentication, then you can use that directly with AD without needing to secure the channel as those authentication mechanisms are already secure without channel encryption. ... Simple bind is the authentication mechanism in the LDAP V3 spec and is supported by all LDAP directories. ...
    (microsoft.public.windows.server.security)